For the second consecutive year, the DPRK has recorded its most profitable year to date for crypto theft. Security incidents in the cryptocurrency market in 2025 revealed that losses were even higher than the previous year.
They point to a structural shift in how crypto-related crime is unfolding. From January through early December, more than $3.4 billion in digital assets was stolen worldwide, with a single incident—the March hack of Bybit—accounting for approximately $1.5 billion of the total. The year’s figures are therefore shaped less by a broad increase in attacks than by the concentration of losses in a small number of exceptionally large breaches.
This pattern is documented in Crypto Crime Analysis 2025, published by blockchain analytics firm Chainalysis. According to the report, crypto theft in 2025 was not the cumulative result of many incidents but was instead driven by a handful of large-scale compromises that effectively determined the annual loss total. The three largest service-level hacks accounted for 69% of all losses, while the gap between the single largest incident and the median loss exceeded 1,000 times for the first time on record.
Such a shift in distribution highlights the limitations of traditional security approaches. Strategies focused primarily on reducing the number of incidents struggle to contain overall losses in an environment where the impact of a single breach has grown disproportionately large. The center of gravity in crypto security is moving away from frequency management toward limiting the systemic fallout of individual failures.
This vulnerability is particularly evident among centralized services. Private key compromises remain relatively infrequent, but when they occur, the scale of losses is overwhelming. In the first quarter of 2025, this category alone accounted for 88% of total losses. The data underscore that even organizations with substantial security resources remain exposed to structural weaknesses in key management.
Against this backdrop, North Korea (DPRK) stands out as the most consequential threat actor. Chainalysis estimates that North Korea–linked hacking groups stole at least $2.02 billion in cryptocurrency in 2025, a 51% increase from the previous year. Attacks attributed to the DPRK accounted for 76% of all service-level losses, bringing the lower-bound estimate of cumulative crypto theft linked to North Korea to approximately $6.75 billion.
What distinguishes 2025, however, is that these record losses were achieved with far fewer confirmed incidents than in prior years. The inverse movement of attack frequency and total losses suggests a strategic shift from quantitative expansion to qualitative concentration. The report attributes this change in part to the infiltration of IT workers into crypto exchanges, custodians, and Web3 firms. Once internal access is secured, lateral movement and privilege escalation become easier, enabling high-value thefts.
North Korea–linked actors also exhibit distinct laundering behavior. While the total amounts stolen are larger, on-chain movements are typically broken into smaller tranches, most commonly below $500,000. More than 60% of DPRK-associated fund movements fall within this range. By contrast, non-DPRK criminals tend to favor transactions in the $1 million to $10 million range or higher. The preference for smaller transfers reflects a deliberate emphasis on evasion and obfuscation.
The choice of laundering routes further reflects the constraints and objectives facing DPRK-linked actors. Chainalysis notes a strong reliance on Chinese-language guarantee and money-movement services, cross-chain bridges, mixing services, and a small number of specialized platforms. In contrast, these actors show relatively limited use of DeFi lending protocols, peer-to-peer trading platforms, and no-KYC exchanges compared with other criminal groups. Under conditions of restricted access to the international financial system, pathways that balance cash-out potential with reduced traceability appear to be favored.
The report also identifies a recurring operational timeline. Following major DPRK-linked hacks, stolen funds tend to move through a three-phase process over approximately 45 days. In the first five days, activity spikes in DeFi protocols and mixing services as funds are rapidly layered. Between days six and ten, flows shift toward limited-KYC exchanges and cross-chain bridges, fragmenting assets across networks. From roughly day 20 to day 45, final integration becomes visible through no-KYC exchanges, guarantee services, and OTC networks. Some funds, however, may remain dormant for extended periods or move through channels that are not observable on-chain.
Losses affecting individual users are also expanding in scale, though in a different way. An estimated 158,000 personal wallet compromises occurred in 2025, with the number of victims rising sharply. Yet the total value stolen from individuals declined from its 2024 peak, indicating a pattern in which attackers target more users while extracting smaller amounts per victim. When adjusted for active wallet counts, Ethereum and Tron recorded particularly high victimization rates, suggesting that user demographics, application ecosystems, and criminal infrastructure play roles alongside technical factors.
Decentralized finance followed a contrasting trajectory. Despite a recovery in total value locked (TVL) during 2024–2025, DeFi-related losses did not rise in tandem. Chainalysis attributes this divergence either to improvements in monitoring and response capabilities or to a shift in attacker focus toward centralized services and personal wallets. The September 2025 incident involving Venus Protocol is cited as an example in which early detection, rapid intervention, and governance mechanisms combined to contain losses.
Taken together, the data from 2025 suggest that crypto-related crime is not simply expanding but becoming more concentrated. North Korea, in particular, appears to have refined a model capable of generating system-wide impact through a limited number of successful operations. As the industry looks toward 2026, the central challenge is less about whether breaches will occur and more about how effectively the pathways through which single failures propagate across the ecosystem can be constrained.
