When most people think of crypto hackers, they picture shadowy figures stealing NFTs or phishing people out of Bitcoin. But for North Korea, it’s become far more serious and strategic.
Over the past few years, Pyongyang has turned to crypto theft on an industrial scale, using stolen digital assets to prop up its heavily sanctioned economy and, more worryingly, to bankroll its nuclear weapons program. In February 2025, the Lazarus Group, North Korea’s elite state-backed hacking unit, was behind a jaw-dropping $1.5 billion crypto theft from Bybit, a major exchange based in Dubai. That’s not a typo: billion with a “b.”
This wasn’t a simple smash-and-grab either. These attackers are seasoned pros, with tactics ranging from fake job offers to weaponized apps. Once they get into a system, they move the stolen funds across multiple blockchains and decentralized exchanges, making money nearly impossible to trace in real-time.
According to a tweet from Reuters, this may not be the first time either:
North Korea is funding its weapons program with cryptocurrency stolen through cyberattacks. Hackers stole more than $50 million from at least three cryptocurrency exchanges between 2020 and mid-2021, according to a U.N. report https://t.co/EkLEJwPjdj pic.twitter.com/edPXkjsaV3
— Reuters (@Reuters) February 8, 2022
Since 2017, the regime is believed to have pulled off 50+ attacks like this, racking up close to $3 billion. And unlike most hackers looking to cash out on Lambos or luxury real estate, North Korea has a different shopping list—missile parts, uranium-processing tools, and sanctions-busting imports.
Tactics and Global Reach of North Korea Crypto Hackers Lazarus Group
The Lazarus Group doesn’t just hit one region—they go global. Their cyber fingerprints have shown up in the U.S., South Korea, Japan, and across Europe. They’ve posed as everything from crypto recruiters to venture capital firms. They’ve even built fake versions of popular wallet apps to trap unsuspecting users.
Once inside a network, they move fast, extracting crypto and rapidly swapping it for privacy coins or stablecoins before the alarm bells can even ring. This playbook has made them one of the most successful and dangerous hacking operations in the world.
International Response and Challenges to North Korea Crypto Hacks
Governments are taking this seriously, but keeping up is a different story. The U.S. has indicted some Lazarus operatives, and agencies like the FBI and DOJ have issued public alerts warning companies and exchanges to stay on high alert.
But the hard truth? Crypto’s structure makes enforcement difficult. Unlike traditional bank accounts, digital wallets can be anonymous, fast-moving, and scattered across thousands of platforms. Once the funds are gone, tracing them becomes a high-stakes game of digital hide-and-seek.
And it’s not just crypto theft. Investigations have also uncovered that North Korea is using forged documents and complex shipping routes to acquire sensitive tech, like vacuum furnaces used in uranium enrichment. In one case, the equipment passed through multiple countries before quietly ending up in Pyongyang—dodging sanctions every step of the way.
Implications for Global Security in Crypto Era
It’s no longer just about cybersecurity or stolen tokens. This is about a regime using digital crime to bypass global restrictions and fuel its weapons program. And while the damage may feel abstract to most of us, the stakes are very real.
Cracking down on these operations will require more than just patching up firewalls. It’ll take global cooperation, smarter regulations, and much more transparency in the crypto space.
Because when billion-dollar hacks start funding nuclear programs, it stops being a tech problem—and becomes a global one.
DISCOVER: 20+ Next Crypto to Explode in 2025
Join The 99Bitcoins News Discord Here For The Latest Market Updates
Key Takeaways
- North Korea has turned crypto hacking into a state-sponsored operation, using stolen funds to support its economy and nuclear weapons program.
- In February 2025, the Lazarus Group stole a staggering $1.5 billion from Bybit—marking one of the largest crypto thefts in history.
- Their tactics include fake job offers, malicious wallet apps, and rapid laundering across blockchains to evade detection.
- Since 2017, North Korea is believed to have executed over 50 attacks, stealing nearly $3 billion in crypto.
Why you can trust 99Bitcoins
Established in 2013, 99Bitcoin’s team members have been crypto experts since Bitcoin’s Early days.
Weekly Research
100k+Monthly readers
Expert contributors
2000+Crypto Projects Reviewed
Free Bitcoin Crash Course
- Enjoyed by over 100,000 students.
- One email a day, 7 days in a row.
- Short and educational, guaranteed!
Maximize Your Trading With Margex’s 20% Deposit Bonus
‘Buy in May, Get Paid in June?’ – $300K Bitcoin Calls Heat Up, BTC Bull Token Is Locked In
CoinGecko Report Analysis: What Moved Crypto in Q1 2025?
14 Best Crypto Bonuses in 2025 – Top Exchange Offers & Promotions
BingX Launches $10 Risk-Free Copy Trading Voucher for New Users in Exclusive Event
