Topic starter
14/07/2026 6:06 pm
TL;DR: North Korean-linked hackers stole $2 billion in crypto in 2025 and $6 billion cumulatively, with $1.46 billion taken from Bybit and roughly 30 additional incidents making up most of the rest as attacks increasingly target individuals and smaller organisations, according to Swarmnetics. Custody controls now need identity verification, endpoint trust, and social engineering resistance, not just exchange hardening.
Editorial analysis by NHI Mgmt Group, based on content published by Swarmnetics: “$2 Billion in 2025, $6 Billion Total Stolen Crypto for North Korean Hackers as Focus Shifts to Individuals”.
Key questions
Q: What breaks when crypto custody relies on informal trust paths?
A: Informal trust paths fail because attackers can impersonate contacts, send fake updates, or socially engineer approvals without defeating the wallet technology itself.
Q: Why do social engineering attacks against crypto holders become so hard to recover from?
A: They become hard to recover from because the theft can be converted and dispersed within hours.
A: Look for impersonated contacts, fake software update prompts, unusual messaging-based requests, and attempts to move users off established verification channels.
Practitioner guidance
- Harden high-value holder verification Require out-of-band verification for any transfer, software install, or recovery action involving high-balance crypto accounts and privileged staff wallets.
- Separate messaging trust from execution trust Block direct action on requests received through chat, email, or social platforms unless the request is confirmed through a second trusted channel.
- Treat software updates as a control point Verify update provenance for collaboration and wallet-adjacent tools, and train users to reject prompts that arrive through impersonated contacts.
Bottom line: North Korean-linked crypto theft is expanding beyond exchange breaches, which means individuals and smaller firms now sit inside the threat model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 6:11 pm
Targeting has shifted from pure platform compromise to identity-led crypto theft. The article shows that North Korean operators are now optimizing for the weakest human or operational trust path, not only for the largest exchange breach. That matters because once the target is a person or small firm, the control problem extends into identity verification, device trust, and fraud detection rather than staying inside exchange security. Practitioners should treat crypto custody as an identity governance problem as much as a wallet security problem.
A question worth separating out:
A: Accountability should sit with both security and asset owners, because crypto custody is part identity assurance and part transfer governance. Security teams need the verification, endpoint, and monitoring controls, while the business side must define who can approve transfers, recovery steps, and wallet changes under abnormal conditions.
👉 Read our full editorial: North Korean crypto theft is shifting from exchanges to individuals