Topic starter
14/07/2026 6:06 pm
TL;DR: Attacks are increasingly targeting individuals and smaller organisations, with $1.46 billion taken from Bybit and roughly 30 additional incidents making up most of the rest, according to Swarmnetics. Crypto custody now has to account for identity checks, endpoint trust, and social engineering, not only exchange defenses.
Editorial analysis by NHI Mgmt Group, based on content published by Swarmnetics: “$2 Billion in 2025, $6 Billion Total Stolen Crypto for North Korean Hackers as Focus Shifts to Individuals”.
Key questions
Q: Why do social engineering attacks against crypto holders become so hard to recover from?
A: They become hard to recover from because the theft can be converted and dispersed within hours.
A: Look for impersonated contacts, fake software update prompts, unusual messaging-based requests, and attempts to move users off established verification channels.
Q: What breaks when crypto custody relies on informal trust paths?
A: Informal trust paths fail because attackers can impersonate contacts, send fake updates, or socially engineer approvals without defeating the wallet technology itself.
Practitioner guidance
- Harden high-value holder verification Require out-of-band verification for any transfer, software install, or recovery action involving high-balance crypto accounts and privileged staff wallets.
- Separate messaging trust from execution trust Block direct action on requests received through chat, email, or social platforms unless the request is confirmed through a second trusted channel.
- Treat software updates as a control point Verify update provenance for collaboration and wallet-adjacent tools, and train users to reject prompts that arrive through impersonated contacts.
Bottom line: North Korean-linked crypto theft is expanding beyond exchange breaches, which means individuals and smaller firms now sit inside the threat model.
Glossary terms: Crypto Custody Model, Social Engineering, Trust Laundering, Endpoint Trust Assumption
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
14/07/2026 6:11 pm
Targeting has shifted from pure platform compromise to identity-led crypto theft. The article shows that North Korean operators are now optimizing for the weakest human or operational trust path, not only for the largest exchange breach. That matters because once the target is a person or small firm, the control problem extends into identity verification, device trust, and fraud detection rather than staying inside exchange security. Practitioners should treat crypto custody as an identity governance problem as much as a wallet security problem.
A question worth separating out:
A: Accountability should sit with both security and asset owners, because crypto custody is part identity assurance and part transfer governance. Security teams need the verification, endpoint, and monitoring controls, while the business side must define who can approve transfers, recovery steps, and wallet changes under abnormal conditions.
👉 Read our full editorial: North Korean crypto theft is shifting from exchanges to individuals