CertiK: North Korean Hackers stole $6.75B from crypto projects

Главное:

• CertiK says North Korean hackers remain one of the biggest threats to the global crypto industry.
• Since 2016, groups linked to North Korea have stolen around $6.75 billion through hundreds of attacks.

Blockchain security firm CertiK has released a new report titled Skynet DPRK Crypto Threat Report, warning that North Korean hacking groups are becoming more sophisticated and increasingly difficult to detect.

According to the report, attackers rely heavily on social engineering tactics, fake job offers, insider recruitment within crypto companies, malware deployment, and cross-chain money laundering schemes.

CertiK says North Korean cyber operations remain one of the most serious security threats facing the global crypto industry today.

Since 2016, hackers linked to North Korea have stolen an estimated $6.75 billion across 263 attacks. The real figure could be even higher, as many smaller incidents were never publicly reported.

Hackers from North Korea stole more than $2,8 billion in cryptocurrency

According to the report, the country uses Russian and Asian channels to launder funds and finance nuclear programs

Читать дальше

In 2025 alone, North Korea-linked hackers stole approximately $2.06 billion in crypto assets. That accounted for nearly 60% of all crypto funds stolen during the year, despite being responsible for only 12% of reported security incidents.

The trend has continued into 2026. According to CertiK, North Korean groups are tied to roughly 55% of all crypto losses from attacks this year. One of the biggest incidents was the $291 million KelpDAO hack. Since January 2026, the industry has recorded 185 attacks with combined losses of around $1.1 billion.

Largest Hacks and Evolving Attack Tactics

The February 2025 Bybit breach remains the largest crypto theft in history, with attackers stealing $1.5 billion. Other major incidents highlighted in the report include the $625 million Ronin hack and the $285 million Drift exploit.

Following the Bybit attack, hackers converted more than 86% of the stolen Ethereum into Bitcoin in less than a month. To cover their tracks, they used mixers, blockchain bridges, decentralized exchanges, and OTC brokers.

The report also notes that most major attacks no longer begin with smart contract vulnerabilities, but with manipulation of employees. Hackers use fake recruiting campaigns, impersonate investors, and inject malicious code into company infrastructure.

In some cases, North Korean operatives reportedly joined DeFi projects under false identities, gaining access to internal systems and company funds.