North Korea behind 60% of global crypto theft last year, netting $2b

North Korean hackers are believed to be responsible for about 60 percent of all virtual assets stolen through hacking worldwide last year, amounting to roughly $2 billion. North Korea has also been named as the suspected perpetrator behind a recent hack of Binance, the world's largest virtual asset exchange, in a breach estimated at around $6.3 billion — fueling analysis that cyberattacks have become a primary channel for Pyongyang to secure foreign currency.

According to blockchain analytics firm Chainalysis, North Korean hackers stole an estimated $2 billion in virtual assets last year, accounting for roughly 60 percent of the global total.

North Korea's virtual asset hacking has continued for years. A review of a UN Security Council expert panel report by the British newspaper The Guardian found that from 2017 to 2023, North Korea was linked to 58 attacks on virtual asset firms, with total losses reaching approximately $3 billion.

The scale of the attacks has grown steadily. In 2022, the North Korean hacking group Lazarus was identified as the group behind the theft of roughly $620 million from Ronin Network, a blockchain-based gaming network. In 2024, TraderTraitor — a group believed to operate under Lazarus — was found to have siphoned approximately $308 million from Japanese virtual asset exchange DMM Bitcoin.

TraderTraitor was also identified as the group behind the theft of roughly $1.5 billion from virtual asset exchange Bybit in February last year, which was at the time the largest virtual asset hack ever recorded.

The losses from the Binance hack far exceeded that figure, with damages estimated at approximately $6.3 billion, or about 8.4 trillion won — equivalent to roughly one-fifth of North Korea's gross national income.

The international community has come to view virtual asset theft as a core foreign currency procurement tool for North Korea. The UN Security Council expert panel estimates that funds obtained through hacking account for roughly half of North Korea's foreign currency earnings. Some analyses suggest that about 40 percent of the costs of the country's weapons development programs are covered by funds stolen through cyberattacks.

North Korea's investment in cultivating cyber personnel is seen as closely tied to this strategy. Students who show aptitude in mathematics and science are selected from an early age and put through three to five years of cyberwarfare training, with top performers advancing to specialized programs.

The Committee for Human Rights in North Korea said in a report this year that Pyongyang's Moranbon University operates a five-year curriculum combining military studies, hacking and cryptanalysis. Some elite personnel are also reported to receive additional training in China and Russia.

Meanwhile, Microsoft analyzed that the North Korean hacking group Andariel distributed more than 100 customized PDF documents embedded with malware targeting South Korean public institutions and companies between August and September. Microsoft said the speed and sophistication of North Korea's attacks on South Korea have increased sharply, with AI being used to mass-produce tailored lure documents matched to targets' job titles and interests within minutes.