According to analytics firms and intelligence agencies, North Korea has transformed cybercrime into a fully-fledged state industry. Today, North Korean hackers account for more than 3 out of every 4 dollars stolen in cryptocurrency worldwide. Digital assets have become the isolated regime's primary tool for evading international sanctions and funding its weapons and missile programs.

šŸ“ˆ Escalation of the Crypto Theft Market

The growth of North Korea's share in the total volume of stolen cryptocurrency is striking in its progression:

2020: 7%

2021: less than 10%

2022: 22%

2023: 37%

2024: 39%

2025: 63%

2026: 85%

According to analytics firm TRM Labs, the total amount of cryptocurrency stolen by DPRK hackers since 2017 has reached $12.8 billion.

These figures are equally staggering when compared to the country's legal economy: in just the first nine months of 2025, its hackers stole at least $1.65 billion (according to data from 11 governments), which is 3.5 times more than North Korea earned from all of its legal exports that year.

šŸ•µļøā€ā™‚ļø Key DPRK Cyber Units

According to the U.S. Department of the Treasury, North Korean hackers operate within specialized units managed by the country's primary intelligence agency. The most prominent groups include:

Lazarus Group — The most notorious hacking collective, linked by the FBI to the 2022 incident where $620 million was stolen from the Ronin network.

TraderTraitor — The FBI's designation for the group of hackers behind major thefts from exchanges including Bybit (highlighted by a $1.5 billion hack in February 2025), DMM Bitcoin, and Binance.

Andariel — A group specializing in ransomware attacks. The U.S. has offered a $10 million reward for information on one of its alleged members following cyberattacks targeting healthcare institutions.

🌐 Beyond Cryptocurrency: Global Cybersabotage

Financial heists represent only a portion of DPRK's cyber operations. Western governments have accused the regime of conducting a series of high-profile cyberattacks:

Sony Pictures (2014): Thousands of company computers were rendered operational-disabled in retaliation for the release of a satirical film.

Central Bank of Bangladesh (2016): State-backed hackers stole $81 million via the SWIFT international payment system.

WannaCry Ransomware (2017): A massive ransomware worm infected approximately 300,000 computers across 150 countries, paralyzing enterprises and the UK's National Health Service (NHS).

NASA and U.S. Air Force Bases (2024): Breaches of government databases detailed in U.S. Department of Justice indictments.

Ransomware Attacks on U.S. Hospitals: Repeated disruptions of healthcare facility operating systems (including a Kansas medical center forced to pay roughly $100,000 in ransom).

Despite continuously tightening international sanctions and active investigations by the FBI and law enforcement agencies globally, North Korea's cyber units continue to scale their operations, rapidly adapting to new defensive mechanisms across the financial sector.