A Good Year for North Korean Cybercriminals

Summary

North Korean state-linked cybercriminal groups saw an exceptionally profitable 2025, driven largely by large-scale cryptocurrency thefts. Chainalysis attributes at least $2.02 billion in cryptocurrency thefts to DPRK-linked actors so far this year — including a $1.5 billion Ethereum heist from exchange ByBit in February — forming the bulk of the $3.4 billion in stolen digital assets tracked for 2025. Over the past four years these groups have taken at least $6.75 billion.

Key operators such as Lazarus and several UNC-designated clusters used sophisticated supply-chain compromises, fake tech-worker personas, AI/LLM-enhanced social engineering, and advanced laundering tactics that fragment funds across many channels. Analysts warn of growing cooperation opportunities with Russian actors after a 2024 strategic partnership, and increased reliance on Southeast Asian and Chinese laundering services rather than centralised exchanges.

Key Points

Chainalysis reports DPRK-linked groups stole at least $2.02bn in crypto in 2025; $1.5bn came from the ByBit Ethereum theft.
Over the past four years North Korean-linked cybercrime has extracted at least $6.75bn in crypto assets.
Lazarus is credited with several major operations, using supply-chain compromises and fake tech-worker infiltration to gain access.
Groups increasingly use AI and large language models to improve phishing, social engineering, and tooling.
Money-laundering techniques now favour rapid fragmentation and many small transfers through Southeast Asian liquidity services and Chinese money-laundering networks.
Cybercrime generates an estimated ~7% of North Korea’s GNI, making it a material revenue source for the regime.
Geopolitics: a 2024 DPRK–Russia strategic partnership may deepen technical and cybercriminal collaboration, raising sanctions-evasion risks.

Context and Relevance

This reporting matters for security teams, crypto firms, regulators and policy-makers. It highlights evolving threats: supply-chain compromise, human-in-the-loop infiltration (fake hires), and AI-assisted social engineering — all of which complicate detection and response. The laundering trends described show attackers shifting away from obvious on-ramps to more opaque regional liquidity providers, increasing the challenge for financial investigators and compliance teams.

For organisations: hardening third-party software development processes, tightening vetting of remote hires, and improving phishing defences (including AI-generated lure detection) are immediate priorities. For the crypto ecosystem: enhanced monitoring of fragmentation patterns and collaboration with regional partners will be crucial to disrupt laundering flows.

Why should I read this?

Because this isn’t just another crypto theft story — it explains how state-backed groups are getting smarter, quieter and richer. If you care about protecting wallets, supply chains or your workforce from impersonation and AI-enhanced phishing, this saves you time: it pulls together the methods, the scale and the likely next moves so you can prioritise real, practical defences.

Source

Source: https://www.darkreading.com/cyberattacks-data-breaches/good-year-north-korean-cybercriminals