Blockchain analytics firm Elliptic published a landmark report on October 7, 2025, revealing that North Korean state-sponsored hackers have stolen more than $2 billion in cryptocurrency so far this year — the largest annual total on record, with three months still remaining. The figure represents a dramatic escalation from the previous record of $1.35 billion set in 2022 and pushes the regime’s total stolen crypto since 2017 past $6 billion.
The Exploit Mechanics
What makes the 2025 campaign particularly alarming is the shift in tactics. According to Elliptic, the majority of hacks this year have been perpetrated through social engineering attacks, where hackers deceive or manipulate individuals to gain access to cryptocurrency holdings. This represents a fundamental pivot from earlier campaigns where technical flaws in crypto infrastructure were exploited to steal funds. The largest single incident — the $1.4 billion theft from exchange Bybit in February 2025 — was attributed to North Korea by the FBI and multiple blockchain monitoring firms. Other high-profile victims include Axie Infinity, which lost $625 million in 2022, Harmony at $100 million the same year, and WazirX with $235 million stolen in 2024. North Korea’s main targets remain cryptocurrency exchanges, but Elliptic notes a growing focus on high-net-worth individuals who hold substantial crypto portfolios.
Affected Systems
The social engineering campaigns leverage sophisticated impersonation tactics, including fake job recruitment schemes — a method previously documented by the governments of Japan, South Korea, and the United States, which jointly accused North Korean hackers of stealing more than $659 million through similar approaches in 2024. The attackers create elaborate fake identities, complete with fabricated employment histories at legitimate tech companies, to infiltrate target organizations. Once inside, they deploy malicious code or manipulate transaction approvals. The United Nations Security Council believes the stolen funds are used to finance North Korea’s nuclear weapons program, making these attacks not just financial crimes but matters of international security.
The Mitigation Strategy
Elliptic emphasizes that “the weak point in cryptocurrency security is increasingly human, rather than technical.” This assessment calls for a fundamental rethinking of security protocols across the industry. Organizations should implement multi-layer verification for all transaction approvals, conduct regular social engineering awareness training, and establish strict protocols for onboarding remote workers with access to sensitive systems. Multi-signature wallets with hardware key requirements can add friction that prevents single-point-of-failure social engineering attacks. Exchange operators should consider behavioral analysis systems that flag unusual transaction patterns before execution.
Lessons Learned
The $2 billion milestone underscores several critical lessons. First, attribution remains challenging — Elliptic acknowledges awareness of many thefts that share hallmarks of North Korean activity but lack sufficient evidence for definitive attribution, and other thefts likely remain unreported. Second, the shift toward social engineering means that even organizations with robust technical security remain vulnerable if their personnel can be manipulated. Third, the sheer scale of theft — $6 billion since 2017 — demonstrates that current defensive measures across the industry remain inadequate to address a state-sponsored adversary of this sophistication.
User Action Required
Individual crypto holders should verify all communications through independent channels, never approve transactions under time pressure, use hardware wallets for significant holdings, and enable all available security features on exchange accounts. With Bitcoin trading at approximately $121,450 and Ethereum near $4,450 on this date, the total value at risk across the crypto ecosystem has never been higher, making personal vigilance more critical than ever. The threat landscape has evolved — and so must every participant’s approach to security.
This article is for informational purposes only and does not constitute financial or security advice. Always conduct your own research before making security decisions.
$2B stolen in 2025 and the biggest shift is from code exploits to social engineering. Bybit losing $1.4B to a fake interface trick is devastating
$6B total since 2017 and three months left in 2025. the pace is accelerating not slowing. every CEX is a target now
Lazarus pivoting to social engineering means no amount of smart contract auditing will save you. the weakest link is always a person with wallet access
2 billion stolen and the UN estimates thats funding 30% of NK missile program. every time someone skips a smart contract audit a dictator gets a new rocket
Formal verification should be mandatory for high-value protocols
mempool_watch formal verification helps but it wont stop fake job recruitment schemes. the defense needs to be organizational not just technical
Bug bounties are the most cost-effective security investment
Hardware wallet adoption is the single biggest security improvement anyone can make
Lazarus groups figured out something infosec has known for years. you dont break the crypto, you break the person operating it. much cheaper and scales infinitely
$6B total stolen since 2017 and 2025 alone accounts for $2B. the pace is accelerating not slowing down
$6B since 2017 and the pace is literally doubling year over year. at this rate 2026 hits $4B easy. where does it stop
Nadia K. 6B since 2017 doubling annually. one more year at this pace and NK hackers outearn most legitimate crypto projects
6B total since 2017 and accelerating. by the time an exchange notices the social engineering breach the funds are already through a mixer and across 3 chains
the shift from technical exploits to social engineering is the real story. $1.4B from Bybit through deception not code vulnerabilities. humans are the weakest link and always will be
Bybit losing $1.4B through deception not code. the hardest technical problems in crypto arent technical at all
$1.4B from Bybit alone. one attack through social engineering beat every technical exploit combined that year
the fake job recruitment angle is terrifying because it works on technical staff. your dev gets hired for a fake position and the malware is already in your build pipeline
red_team_42 fake job recruitment into your dev pipeline is the scariest attack vector in crypto. one hire and the treasury is gone
build_pipeline_rat the fake job recruitment into your dev pipeline is straight out of the Sony Pictures playbook. Lazarus reused the same playbook for a decade and it still works
red_team_42 the build pipeline compromise is the scary part. once malware is in your CI/CD its game over, signed binaries and everything look legitimate
nk_shift the social engineering pivot makes sense. why spend months finding a zero day when you can just hire a dev with a fake job listing
dfir_rat the fake job listings on LinkedIn were incredibly sophisticated. one of my former colleagues almost took a call with a recruiter who turned out to be Lazarus social engineering. the CV and company website were flawless
Min-jae K. was that the Jump Crypto incident? heard they had someone embed malicious code via a compromised developer who went through 4 rounds of legit looking interviews
the shift from technical exploits to social engineering is telling. infrastructure got harder to crack so they target the humans instead. same playbook as traditional cyberespionage
$1.4B from Bybit alone. the FBI attribution happened fast which means the on-chain tracing was conclusive. Lazarus is getting sloppier or we are getting better at tracking