Hackers from North Korea stole more than $2,8 billion in cryptocurrency

Key points:

• The international MSMT group said that North Korea has stolen more than $2,8 billion in cryptocurrency since 2024.
• The funds are laundered through intermediaries in Russia, Cambodia, and Hong Kong, and the money obtained is used to finance nuclear and missile programs.
• The report also notes the use of AI and the DPRK’s cooperation with Russian cyber groups.

The Multilateral Sanctions Monitoring Team (MSMT), consisting of 11 countries, including the US, Japan, and South Korea, has published a report on North Korea’s violations of sanctions.

It states that from January 2024 to September 2025, North Korean hacker groups stole at least $2,837 billion in cryptocurrency. The main targets were large exchanges, with the scale of theft reaching $1,645 billion in the first nine months of 2025.

Key findings of the report

The report notes that North Korea launders money through intermediaries in Russia, Hong Kong, and Cambodia, using platforms such as Huione Payment, a subsidiary of Huione Group, to convert cryptocurrencies into cash. North Korea also cooperates with Russian groups involved in the development of ransomware and uses artificial intelligence tools.

In October, the US Financial Crimes Enforcement Network (FinCEN) added Huione Group to its list of organizations suspected of money laundering. Although the Central Bank of Cambodia revoked Huione Pay’s financial license, the platform continues to operate locally.

The report also indicates that there are about 1000-2000 IT specialists in North Korea who work remotely under false names in Russia, Laos, Cambodia, and several African countries. They transfer their salaries to North Korea to finance nuclear weapons and missile projects.

In early October, the analytics company Elliptic presented its own data. According to its estimates, state-affiliated hackers have stolen more than $2 billion in cryptocurrency since the beginning of 2025. Experts believe that the actual losses may be even higher, as some attacks go unnoticed or are not disclosed publicly.