North Korean Hackers Account for 76% of Crypto Stolen in 2026

North Korea has long been accused of stealing digital assets to evade international sanctions and generate foreign currency. The Royal United Services Institute, a UK think tank known as RUSI, said Pyongyang is increasingly relying on established criminal networks and scam groups to process illicit proceeds, making the money trail harder to follow and raising sanctions-compliance risks for financial institutions worldwide.

North Korea stole at least $2.8 billion in cryptocurrency during 2024 and 2025, according to RUSI’s latest report. The assets were sold at a discount or blended with proceeds from scams before underground money brokers in Southeast Asia converted them into cash. RUSI said the laundering chain allows Pyongyang to turn stolen crypto into usable funds that can help finance its weapons programs.

Crypto “wrench attacks” use kidnapping, assault or other physical threats to force holders to surrender private keys or transfer digital assets. The tactic exploits a defining feature of cryptocurrency: blockchain transactions are generally irreversible, leaving victims with limited options once funds are sent. Criminal groups are also targeting relatives and other people close to wealthy holders, turning personal security into a growing risk alongside hacking and online fraud.

More than $30 million in cryptocurrency was stolen through violent attacks in the first half of 2026, according to a report from blockchain analytics firm Chainalysis, putting the year on pace for a record. The cases increasingly involved home invasions and threats against victims’ friends or family members. France recorded the largest number of publicly reported incidents through June 2026, emerging as the leading hotspot for such attacks.

North Korea’s central bank oversees currency issuance and state funds, while the Foreign Trade Bank handles foreign payments and currency transactions. The alleged ring included veterans of a military intelligence cyber-operations unit and IT specialists recruited from leading universities. Their suspected use of state-developed hacking expertise against two pillars of the country’s financial system marks an unusual insider breach and exposes vulnerabilities within an apparatus better known for conducting cyber theft abroad.

Daily NK reported on July 24 that North Korea’s security agency raided a Pyongyang safe house on the night of July 12, 2026, arresting alleged ringleaders and IT personnel. Investigators said the group diverted trade funds and foreign currency in small increments, sent them to overseas crypto wallets and used brokers in China to convert the assets into U.S. dollars and Chinese yuan. Authorities did not disclose the amount stolen or the number arrested, but reportedly seized computer equipment worth hundreds of thousands of dollars.

The cryptocurrency industry has long faced the risk of breaches targeting exchanges, DeFi protocols and wallets, with security firm CertiK tracking losses from onchain attacks. While the decline in total losses may appear encouraging, it does not mean defenses have improved in tandem. Attack methods and the damage caused by individual incidents remain key measures of the ecosystem’s security.

Crypto hacks caused $1.32 billion in losses from January through June 2026, down about 46.8% from the same period in 2025, according to CertiK. The firm warned, however, that the decline could create a false impression of improved security. Attackers are becoming increasingly sophisticated and destructive, while North Korean hackers remain a major threat.

Lazarus is regarded as a North Korea-linked hacking group that has long targeted banks, payment systems and cryptocurrency companies to steal funds through cyber intrusions. Financial and digital-asset institutions hold large amounts of high-value assets, leaving them vulnerable to theft and operational disruption if security systems fail to detect an attack.

Cybersecurity firm Fox-IT recently said Lazarus had switched to the newly developed RemotePE malware toolkit. The malware uses in-memory execution and multiple evasion techniques to bypass security tools while establishing remote-access capabilities. However, available information does not specify the report’s publication date, the names of the targeted institutions, the number of victims or the amount of losses.

North Korean hackers have long used false identities to apply for remote IT jobs, gaining access to private keys, core code and internal systems after infiltrating blockchain and AI companies. Such attacks not only lead to cryptoasset theft but also increase the risks facing multinational companies in employee screening and supply-chain security.

A Chainalysis report found that North Korean hackers stole about $2.02 billion in cryptoassets in 2025, up 51% year on year and accounting for roughly 60% of the global total stolen. CertiK put the figure at $2.06 billion. In a recent case, an interviewer exposed a North Korean operative posing as a Japanese engineer by asking the applicant to criticize Kim Jong Un.

North Korea has long used state-backed hacking groups to target cryptocurrency exchanges and related services. Blockchain security firm CertiK said the country has “industrialized” such theft, turning it into a core channel for evading international sanctions and obtaining foreign currency. The proceeds have also been used to fund its nuclear weapons and missile programs.

CertiK’s latest report showed that North Korea-linked hacking groups stole about $2.06 billion in cryptocurrency in 2025, accounting for roughly 60% of global losses from crypto hacks that year. The report said North Korea has built systematic operations spanning attacks, asset transfers and money laundering, indicating that the activity has evolved from isolated crimes into a state-level revenue model.

North Korea has long faced sweeping United Nations sanctions that restrict its legal exports and access to the financial system. It has consequently made cryptocurrency theft an important source of foreign currency to fund its nuclear weapons and ballistic missile programs. SVRN Chief Operating Officer Dave Schwed said Pyongyang targets exchanges, wallets and DeFi platforms rather than treating cryptocurrency merely as a payment tool.

CoinDesk reported on April 12, 2026, that North Korean hackers had recently spent six months infiltrating Drift, using false identities and long-term relationship-building to gain critical access. In the February 21, 2025, attack on Bybit, they moved $1.5 billion in about 30 minutes. The incident underscored both the difficulty of reversing on-chain transactions and the extremely short window for blocking stolen funds.

North Korea has long used overseas IT workers posing as job applicants to infiltrate crypto projects and gain salaries, system access and digital assets. The network uncovered by blockchain investigator ZachXBT involved about 140 people, indicating that the operation had developed into a sizable, sustainable source of foreign currency that could help North Korea evade international sanctions.

As of July 19, 2026, data released by ZachXBT showed that the team earned about $1 million a month from IT jobs and crypto scams. Members used simple passwords such as “123456” to manage payment and ranking platforms. Stolen crypto was converted into fiat currency and then transferred to Chinese bank accounts.

North Korea has long used IT workers posing as overseas contractors to secure blockchain development work, earning foreign currency and gaining access to core DeFi privileges. Security researcher Taylor Monahan said some of these workers have more than seven years of experience. The networks are believed to have ties to Lazarus Group, highlighting shortcomings in existing identity screening and defense strategies.

A recent investigation found that North Korean IT workers had infiltrated more than 40 crypto platforms and DeFi protocols, and were suspected of outsourcing work to non-North Koreans. Related attacks include the theft of about $625 million from Ronin Bridge in March 2022 and the theft of about $235 million from Indian exchange WazirX in July 2024.