Simply put
- The amount of cryptocurrency stolen by hackers in the first half of 2025 has reached record levels.
- Hackers have taken over $2.1 billion in that timeframe.
- According to TRM Labs, a blockchain intelligence firm, North Korean hackers are primarily to blame.
In the first six months of 2025, hackers stole $2.1 billion from the cryptocurrency market, marking a substantial increase, with North Korea-linked actors responsible for around 70% of this theft, based on a report from TRM Labs.
The report titled “H1 2025 Crypto Hacks and Exploits: A New Record in Evolving Threats” indicates that this total is 10% higher than the previous record set in 2022, with North Korean groups reportedly responsible for about $1.6 billion of the stolen assets.
TRM describes North Korea as “the most prolific nation-state threat actor in the crypto space.”
The report notes that for North Korea, theft is an essential strategy for advancing its technological capabilities.
This significant amount of stolen funds this year was largely driven by a theft in February, where around $1.5 billion worth of Ethereum and related assets were pilfered from the Crypto Exchange Bybit. This incident is labeled as the largest hack in the crypto industry’s history.
A multi-signature wallet provider, Safe, revealed that the breach originated from a developer’s laptop. The investigation indicated that secure developer workstations were compromised on February 4 when interacting with a malicious software application.
Authorities have condemned North Korean hackers for exploiting a Dubai-based exchange, and TRM’s findings echo this sentiment.
“The February 2025 Bybit breach… significantly alters the annual narrative, inflating the average size of hacks and illustrating the strategic use of cybercrime by nation-states,” the report states.
U.S. authorities have long contended that North Korea’s government employs hackers to finance its nuclear programs.
Many major crypto hacks are traced back to the country led by dictator Kim Jong Un.
TRM Labs indicated that these crypto crimes are increasingly “symbolic or strategic rather than purely financially motivated, illustrating a shift in how cybercrime is utilized as a weapon.”
The report also highlights that 80% of the losses this year stemmed from infrastructure attacks, with hackers gaining access to private keys and seed phrases.
