According to blockchain analytics firm Elliptic, hackers serving the North Korean government have stole over $2 billion in cryptocurrency so far this year.
Elliptic released a blog post on Tuesday, stating the new estimate. The estimate is “the largest annual total ever, although still three months left,” based on more than 30 hacks this year, the company said.
Previous records were in 2022, when North Korea stole $1.35 billion. Elliptic says the total amount of cryptocurrencies the administration has stolen since 2017 is at least $6 billion, but that figure could still be undervalued.
“The actual numbers could be even higher. Accidenting the cause of cyber theft to North Korea is not an exact science,” the blog post states.
“We recognize many other thefts that share some of the characteristics of North Korea-related activities, but there is not enough evidence to conclusively attribute. Other thefts have probably not been reported and remain unknown,” Elliptic said.
The company said North Korea’s main target is still crypto exchanges, but administration hackers are beginning to target “wealthy” who own a large number of cryptocurrencies.
This is not the only recent change, the company said.
“The majority of the hacks in 2025 were caused by social engineering attacks in which hackers deceive and manipulate individuals in order to gain access to cryptocurrency,” the blog post states. “This often illustrates a shift from previous attacks that exploited technical flaws in cryptocurrency infrastructure to steal funds. This shift highlights the weaknesses of cryptocurrency security are increasingly human, rather than technical.”
Elliptic’s estimates appear to match estimates from other organizations. Last year, the UN Security Council estimated that North Korean hackers stole $3 billion in cryptocurrency between 2017 and 2023. Adding Elliptic’s estimates of $2 billion this year and $742.8 million last year, the total amount is close to $6 billion.
Governments in Japan, South Korea and the US have accused North Korean hackers of stealing more than $659 million in 2024, roughly the same as Elliptic.
The United Nations believes that Kim Jong Un’s administration is using stolen cryptocurrencies to fund its nuclear weapons program.
This year’s records were primarily driven by a massive theft of over $1.4 billion from cryptocurrency exchange Bybit, but the FBI and several blockchain surveillance companies and researchers consider it to be from North Korea.
Other longtime victims of North Korean hackers in the cryptocurrency world include Play to Earn Games Axie Infinity ($625 million in 2022), cryptocurrency startup Harmony ($100 in 2022), and cryptocurrency exchange WazirX ($235 million in 2024).
