New numbers show that North Korea-linked thieves stole more than two billion dollars’ worth of crypto in the first part of 2025, pushing losses to over six billion since the start of 2024 according to Elliptic. After laundering through multiple steps, a portion is said to fund weapons programs banned by United Nations sanctions, and every exchange, bridge or company that keeps crypto on a blockchain faces direct loss.
The report attributes the biggest raids to Lazarus and similar units. The largest single case hit Bybit in February 2025, when one and a half billion dollars disappeared and three hundred million of that has already been laundered.
Earlier cases include two hundred but also seventy-five million from KuCoin, along with one hundred million from Harmony, one hundred million from Atomic Wallet and twenty-one million from SBI Crypto. Elliptic notes that the 2025 haul is already larger than any full year amount in the past.
Attackers break in using three tools at once: software bugs, malware like BeaverTail and fake job ads that trick staff into handing over private keys. After the coins leave victim wallets, they move through mixers, cross-chain swaps and low-profile blockchains. A mixer is a service that shuffles coins so outsiders cannot see where each coin came from. Chainalysis besides Elliptic track the money and link the transfers to North Korean operators.
Large-scale attacks and laundering methods
Two billion dollars have been stolen in 2025, lifting the running total above six billion since 2024. The Bybit hack in February 2025 took one and a half billion, with three hundred million already laundered. Tools include malware, fake hiring ads and mixers, and Lazarus is identified by forensic firms as the main group.
Losses in 2025 have already surpassed two billion and the biggest raids are tied to Pyongyang-linked groups. The next test for the market is whether tracing tools alongside joint regulation improve outcomes in the coming quarters.
