Overview

• Elliptic estimates North Korea-linked actors have stolen more than $2 billion in crypto so far this year, already a record annual total.
• February’s Bybit breach accounted for about $1.46 billion in losses, a theft the FBI has attributed to North Korean operatives.
• Researchers have connected more than 30 additional 2025 incidents to the same ecosystem, including attacks on WOO X, Seedify, LND.fi, and Taiwan’s BitoPro.
• Targets now include wealthy individuals and exchange staff, with hackers using phishing, fake recruiting and other deception rather than primarily exploiting software flaws.
• Laundering techniques include multi-hop cross‑chain swaps, mixers, obscure blockchains and self‑issued tokens; Elliptic says the tally likely understates losses that UN and agencies say help fund weapons programs, which Pyongyang denies.