How North Korea Stole $3 Billion in Crypto: The Tactics Behind the Heists

Imagine a bank robbery where no alarms sound, no vault doors are forced open, and the thieves never step foot inside the building. Instead, they sit thousands of miles away, typing code that drains billions from digital wallets across the globe. This is not a scene from a movie; it is the reality of state-sponsored cybercrime led by North Korea, which has stolen approximately $3 billion in cryptocurrency between 2017 and 2023. But the story gets darker. In 2024 alone, those figures jumped to $1.34 billion, and by early 2025, a single heist on the Dubai-based exchange Bybit wiped out nearly $1.5 billion in Ether. These aren't random acts of greed by rogue hackers. They are systematic, government-directed operations designed to fund weapons of mass destruction while evading international sanctions.

If you hold crypto, work in fintech, or simply follow global news, you need to understand how this happens. It’s not just about 'hacking' in the Hollywood sense. It’s about social engineering, patience, and exploiting the very trust that makes digital finance work. Here is exactly how Pyongyang pulled off these massive thefts, why they keep succeeding, and what it means for the future of your assets.

The Scale of the Problem: More Than Just Numbers

To grasp the severity, look at the data. Between 2017 and 2023, United Nations Security Council assessments identified 58 separate cyberattacks linked to North Korean groups, totaling roughly $3 billion. That number sounds huge, but the acceleration is what keeps security experts awake at night. In 2024, North Korean-affiliated groups accounted for 61% of all cryptocurrency stolen globally, despite being responsible for only 20% of total incidents.

Why does this matter? Because it shows superior targeting and execution. While other criminal gangs might spray and pray with phishing emails, North Korean groups like Lazarus Group, TraderTraitor, Jade Sleet, UNC4899, and Slow Pisces operate with military precision. They don’t just want quick cash; they want strategic funding for the Democratic People's Republic of Korea (DPRK) regime. The U.S. Department of Defense and the FBI have confirmed that these funds directly support ballistic missile programs and nuclear development. When you click 'buy' on an exchange, you’re entering an ecosystem where one of the most isolated nations on Earth is actively hunting for liquidity.

The Human Element: How Social Engineering Opens the Door

You might think a $308 million heist requires breaking complex encryption. Often, it doesn’t. The most sophisticated part of North Korean attacks isn't the code-it’s the psychology. Take the May 2024 attack on the Japanese platform DMM. The hackers didn’t break into DMM directly. They targeted Ginco, a software company that managed DMM’s wallet infrastructure.

Here’s how it unfolded:

• The Hook: Hackers posed as recruiters on LinkedIn, reaching out to employees at Ginco. Professional networking sites are trusted environments, so victims lowered their guard.
• The Payload: Victims were sent a malicious Python script disguised as a pre-employment test hosted on GitHub. It looked like a standard coding challenge.
• The Compromise: Once the script ran, it compromised the employee’s device. The attacker stole session cookies, allowing them to impersonate the employee without needing passwords.
• The Infiltration: Using the stolen identity, the hackers accessed Ginco’s unencrypted internal communications system. They waited patiently for weeks.
• The Theft: In mid-May, when a legitimate transaction request was made by a DMM employee, the hackers manipulated it. They redirected 4,502.9 BTC (worth $308 million at the time) to their own wallets.

This multi-stage approach highlights a critical vulnerability: human error. No firewall can stop an employee from clicking a link if they believe it’s from HR. North Korean groups exploit professional ambition and routine workflows. They are patient, often waiting months after initial compromise before executing the theft, ensuring they understand the target’s operational rhythms.

From Wallet to Wealth: The Art of Crypto Laundering

Stealing the money is only half the battle. If you steal $1.5 billion in Ether, you can’t just buy a house with it. You need to wash it. This is where blockchain analysis becomes a cat-and-mouse game. After the February 2025 Bybit heist-the largest crypto theft in history-FBI investigations revealed that hackers were "rapidly" converting stolen assets.

They used decentralized exchanges (DEXs) and cross-chain bridges to move funds across different blockchains. For example, stolen Ether might be swapped for Bitcoin, then moved to privacy-focused coins like Monero, or fragmented across thousands of smaller wallets. TRM Labs, a leading blockchain analytics firm, noted that this dispersal obscures the origin of funds, making it incredibly difficult for law enforcement to trace the money back to its source.

Unlike traditional banking, where transactions leave a clear paper trail, crypto laundering exploits the pseudonymous nature of public ledgers. North Korean actors have become proficient at using mixers and tumblers, though regulators are cracking down on these services. The speed at which they convert and move assets suggests institutional knowledge and resources far beyond typical cybercriminal rings.

Who Are the Players? Understanding the Threat Actors

When we say "North Korean hackers," we are referring to specific, tracked threat groups. Each has distinct tactics, techniques, and procedures (TTPs). Understanding who is behind the keyboard helps explain why these attacks succeed.

These groups often collaborate or share tools. For instance, TraderTraitor was responsible for three major incidents in June 2023, stealing over $197 million in two days from Atomic Wallet, Alphapo, and CoinsPaid. The diversity of their targets-from wallets to payment processors-shows they are not limited to one type of victim. They adapt to where the money is concentrated.

Why Do They Keep Winning?

You might wonder: Why haven’t exchanges fixed this? The answer lies in the complexity of modern crypto infrastructure. Many platforms rely on third-party providers for wallet management, cloud hosting, and compliance checks. As seen in the DMM/Ginco case, securing your own platform doesn’t help if your vendor is compromised.

Additionally, the sheer volume of transactions makes real-time monitoring difficult. North Korean hackers exploit time delays. In the Bybit hack, the transfer happened faster than automated safeguards could react. Furthermore, attribution is hard. Chainalysis, the leading blockchain intelligence firm, has had to revise its reports multiple times, initially attributing some hacks to North Korea before finding evidence they were unrelated, while identifying new DPRK-linked incidents. This ambiguity allows hackers to operate in the shadows longer.

There is also a regulatory lag. Laws governing crypto custody, insurance, and liability are still evolving. Exchanges face increased scrutiny and higher insurance costs, but many lack the deep technical expertise to detect advanced persistent threats until it’s too late.

What Does This Mean for You?

If you are an individual investor, the lesson is clear: not all exchanges are created equal. Look for platforms that publish regular security audits, use multi-signature cold storage for the majority of funds, and have transparent incident response plans. Avoid keeping large sums on hot wallets or exchanges with poor track records.

For businesses in the crypto space, the DMM case is a warning. You must vet your vendors rigorously. Assume that any external connection is a potential entry point. Implement zero-trust architecture, enforce strict access controls, and train employees to recognize sophisticated social engineering attempts. A LinkedIn message from a recruiter should never bypass IT security protocols.

On a broader level, this crisis highlights the intersection of finance and national security. Governments are responding with sanctions against crypto mixing services and pressure on exchanges to comply with Know Your Customer (KYC) rules. However, as long as there is profit to be made, North Korea will continue to innovate. The February 2025 Bybit heist proves they are scaling up, not winding down.

The Future of State-Sponsored Crypto Crime

Looking ahead, expect more consolidation of targets. North Korean groups are moving away from small, opportunistic hacks toward high-value, strategic strikes. They are investing in better laundering techniques to evade AI-driven blockchain analysis. We may see increased use of artificial intelligence to craft more convincing phishing campaigns or to identify vulnerabilities in smart contracts automatically.

International cooperation is improving, with the FBI, Japan’s National Police Agency, and others sharing intelligence. But the decentralized nature of crypto means there is no central authority to freeze assets instantly. Until global regulations harmonize and technology catches up with the threat, the risk remains high. The $3 billion figure from 2017-2023 is just the beginning. With the 2024 surge and the 2025 record-breaking heist, the trend line is alarming. Vigilance, education, and robust security practices are no longer optional-they are essential for survival in the digital asset economy.