According to a report by CrowdStrike, North Korean hackers became the biggest threat to the crypto industry in 2025. Despite fewer attacks compared to 2024, the damage increased by 51%—the groups focused on larger targets. The stolen funds, according to the company, almost certainly go toward financing the regime's military programs.
Crypto attracts North Korean hackers because it allows them to launder funds with greater anonymity than in the traditional financial system. The main tools they use are malware and social engineering.
A striking example is the $280 million hack of Drift Protocol. The hackers met the development team at a major crypto conference, built relationships over six months, and then deployed malware onto the developers' computers. Notably, the perpetrators themselves were not citizens of the DPRK—intermediaries were used for personal meetings.
In April, the Ethereum Foundation identified 100 DPRK agents who had infiltrated crypto projects. At the same time, ZachXBT documented a group of North Korean IT workers earning $1 million per month by working under cover in tech companies.
