North Korea stole $2 billion in crypto in 2025. Interpol recovered $439 million. Are attackers hitting a ceiling, or just routing around checkpoints?
Cover art/illustration via CryptoSlate. Image includes combined content which may include AI-generated content.
North Korea-linked hackers stole more than $2 billion in cryptocurrency in 2025, surpassing every prior year on record, while global law enforcement recovered $439 million and arrested hundreds of money launderers across 40 countries in a single four-month operation.
The collision of record state-sponsored heists and coordinated multilateral enforcement raises a sharper question than whether crypto crime is out of control: are attackers hitting a ceiling, or are they learning to route around every new checkpoint governments deploy?
The answer shapes treasury policies, bridge security budgets, and the viability of privacy-preserving infrastructure. If enforcement dents illicit flows, the industry can rely on improved KYC, sanctions, and chain analytics to manage risk.
Suppose attackers adapt by hopping chains, fragmenting cash-outs, and exploiting jurisdictions with weak adoption of the travel rule. In that case, the defensive stack needs architectural changes, not just better compliance theater.
The February 2025 Bybit breach set the scale for the year. The FBI attributed the $1.5 billion theft to North Korea’s Lazarus Group, also known as the TraderTraitor cluster, a multi-year spear-phishing and malware campaign targeting blockchain developers and operations teams.
The attackers delivered trojanized trading applications through supply-chain compromises, gaining access to hot-wallet signing infrastructure.
TRM Labs documented the subsequent laundering: immediate swaps into native assets, bridge hops to Bitcoin and Tron, then layered mixing across obscure protocols.
Chainalysis’ mid-year update confirmed service losses of over $2.17 billion by June 30, with the Bybit theft accounting for the majority.
Elliptic’s October brief raised the total to over $2 billion attributed to DPRK-linked actors alone, noting “escalating laundering complexity in response to better tracing.”
The Japan National Police Agency and the US Department of Defense Cyber Crime Center jointly tied the $308 million DMM Bitcoin loss to the same TraderTraitor infrastructure in late 2024.
Japan’s Foreign Ministry published a 2025 compendium consolidating DPRK cyber-theft methods, laundering routes, and specific incidents over 18 months, establishing attribution standards that rely on malware families, infrastructure overlaps, and on-chain heuristics confirmed by multiple intelligence agencies.
The attack surface has shifted from exchange hot wallets to bridges and validator operations, where single-point failures unlock massive flows.
Elliptic’s 2025 cross-chain crime report measured how often stolen assets now traverse more than three, five, or even ten chains to frustrate tracing.
Andrew Fierman, head of national security intelligence at Chainalysis, described the evolution in a note:
“DPRK launderers are perpetually changing mechanisms for laundering and evasion tactics to avoid disruption.”
He added that mixers remain in the toolkit, as Tornado Cash saw renewed DPRK-linked flows after the Treasury withdrew its sanctions designation in March 2025, following court setbacks. However, the venue mix continues to shift.
After Blender and Sinbad were sanctioned, flows moved to cross-chain decentralized exchanges, USDT corridors, and over-the-counter brokers in Southeast Asia.
Enforcement scaled in 2025. Interpol’s Operation HAECHI VI, which ran from April to August, recovered $439 million across 40 countries, including $97 million in virtual assets.
The coordinated sting followed 2024’s HAECHI V, which set records for arrests and seizures. Europol continued parallel actions against laundering infrastructure and crypto-fraud networks throughout the year.
The Financial Action Task Force’s June 2025 update revealed that the implementation of the travel rule had risen to 85 jurisdictions, with guidance for supervisors tightening cross-border information sharing.
These are material headwinds for cash-out networks that relied on fragmented compliance regimes.
Sanctions and criminal cases now target facilitators as much as hackers. The Office of Foreign Assets Control’s July 2025 actions hit DPRK IT-worker revenue chains, while Department of Justice indictments and forfeitures charged North Korean operatives with crypto theft and laundering.
Prosecutors forced guilty pleas from Samourai Wallet operators, and Wasabi’s coordinator shut down in 2024.
The result is fewer large, centralized laundering hubs and more fragmented, cross-chain obfuscation.
Fierman noted the tactical response:
“Increased Know Your Customer due diligence by exchanges can help disrupt mule accounts, sanctioning of mixers ultimately has driven actors to alternative platforms, which may have less liquidity to facilitate large-scale laundering, and stablecoin issuers’ ability to freeze assets at any point in the supply chain all help disrupt DPRK laundering efforts.”
Attribution standards combine on-chain forensics with signals intelligence and malware analysis.
The FBI publicly confirmed Bybit’s attribution in February 2025, while multiple outlets and Japan’s foreign ministry consolidated evidence linking TraderTraitor to prior thefts.
Target selection has shifted toward exchanges, bridges, and validator pathways, where operational security failures unlock the maximum value.
Chainalysis data shows that 2025 losses were concentrated in service-level breaches rather than individual wallet compromises, reflecting an attackers’ shift toward high-leverage infrastructure targets.
Laundering patterns now regularly route through USDT corridors and OTC off-ramps outside strict regulatory zones. A 2024 Reuters investigation traced Lazarus-linked flows into a Southeast Asian payments network.
Chainalysis and Elliptic document a steady decline in direct exchange cash-outs, from roughly 40% of illicit transfers in 2021-22 to about 15% by mid-2025, and a corresponding rise in complex, multi-hop routing that blends decentralized-exchange swaps, bridges, and cashier networks.
Fierman described the jurisdictional arbitrage:
“DPRK will seek to adjust mechanisms, as recently seen, using everything from large sources of liquidity for laundering, like Huione Group, or leveraging regional over-the-counter traders that either may not be seeking to comply with regulatory requirements, or have lax regulation in their operating jurisdictions.”
The near-term answer is both. Chainalysis finds that direct transfers from illicit entities to exchanges fell to roughly 15% in the second quarter of 2025, implying that screening, sanctions, and exchange cooperation are effective.
Yet, these actions push cash out toward layered cross-chain hops and payment processors outside the strictest regimes.
The FATF’s 2025 data shows that travel rule laws are on the books in most major hubs, but uneven enforcement, and that unevenness is precisely where new laundering corridors form.
There are real frictions on the adversary side. Interpol’s operations and national actions freeze larger slices of illicit balances, and private actors publicize freezes and seizures, underscoring a broader de-risking trend that raises DPRK’s laundering costs.
Stablecoin issuers can freeze assets at any point in the supply chain, a power that concentrates risk in centralized issuers but improves recovery odds when exercised quickly. The question is whether that friction accumulates faster than attackers can route around it.
Treat DPRK-style intrusions as a business-risk scenario, not a black swan.
US TraderTraitor advisories provide practical mitigations, including hardening hiring pipelines and vendor access, requiring code-signing verification for tools, constraining hot-wallet budgets, and automating withdrawal velocity limits.
Additionally, rehearsing incident playbooks that include immediate address screening, bridge-halt policies, and law enforcement escalation paths is also recommended.
The casework indicates that early freezes, rapid KYC-enabled tracing, and exchange cooperation significantly increase the odds of recovery.
For capital routes, apply pre-approved bridge and decentralized-exchange allowlists with business justification, and extend travel-rule-ready screening to treasury movements to avoid taint backflow.
Chain analytics vendors publish fresh red-flag typologies for cross-chain laundering: bake those into monitoring so alerts tune in for bridge hops and native-asset pivots, not just legacy mixer tags.
Philipp Zentner, founder of Li.Fi, argued that on-chain kill switches face a centralization-versus-responsiveness tradeoff. In a note, he explained:
“A pure on-chain solution without a centralized actor is very unlikely to be achievable. Anything that is not curated can be misused, and anything that is too open could also be used by the hacker themselves. When DEX aggregators and bridges are getting contacted about a hacker, it’s often already too late.”
He added that a centralized solution is much more likely to succeed as of today. That candor reflects the reality that decentralized protocols lack the coordination layer necessary to halt the propagation of theft in real-time without introducing the risk of human-driven centralization.
The composite picture is that enforcement raised the cost and complexity of laundering, but didn’t stop the thefts.
DPRK-linked actors stole more in 2025 than in any prior year, yet they’re now forced to route through ten chains, convert through obscure pairs, and rely on regional OTC brokers instead of cashing out directly at major exchanges.
That’s progress for defenders, detection heuristics, cluster analysis, and cross-border cooperation are working, but it’s also proof that attackers adapt faster than regulators harmonize.
The 2026 test will be whether the next round of enforcement with tighter travel rule implementation, more aggressive stablecoin freezes, and continued multilateral actions compresses the laundering window enough that sophisticated state actors face prohibitive friction.
Or, alternatively, whether they route deeper into jurisdictions with weak supervision and continue to fund operations through crypto theft.
The answer will determine whether the industry can rely on compliance as a core defense or needs architectural changes that harden bridges, limit hot wallet exposure, and build better incident-response coordination into protocols themselves.
Gino Matos is a law school graduate and a seasoned journalist with six years of experience in the crypto industry. His expertise primarily focuses on the Brazilian blockchain ecosystem and developments in decentralized finance (DeFi).
Daily digest of top crypto stories and market insights. Never miss out.
Reports on sanctions, cybercrime, and alleged state-linked hacks targeting digital assets.
Comprehensive crypto news, insights, and data to stay ahead in the digital asset economy.
Stay updated with the latest announcements from leading projects and companies.
Our writers’ opinions are solely their own and do not reflect the opinion of CryptoSlate. None of the information you read on CryptoSlate should be taken as investment advice, nor does CryptoSlate endorse any project that may be mentioned or linked to in this article. Buying and trading cryptocurrencies should be considered a high-risk activity. Please do your own due diligence before taking any action related to content within this article. Finally, CryptoSlate takes no responsibility should you lose money trading cryptocurrencies. For more information, see our company disclaimers.
Launched in 2014, Tether is a blockchain-enabled platform designed to facilitate the use of fiat currencies in a digital manner.
Chainalysis builds trust in blockchains between people, businesses and governments.
TRM Labs is a blockchain intelligence company that helps financial institutions, crypto businesses, and government agencies detect and investigate crypto-related financial crime and fraud.
Elliptic empowers financial institutions and crypto businesses to confidently manage risk and meet AML regulatory compliance worldwide.
Bybit is a cryptocurrency derivative trading platform established in March 2018 and registered in the BVI.
Get the latest crypto news and market analysis straight to your inbox.
We respect your privacy and will never share your email address.
Please add [email protected] to your email whitelist. You may unsubscribe at any time.
Disclaimer: By using this website, you agree to our Terms and Conditions and Privacy Policy. CryptoSlate has no affiliation or relationship with any coin, business, project unless explicitly stated otherwise. CryptoSlate is only an informational website that provides news about coins, blockchain companies, blockchain products and blockchain events. None of the information you read on CryptoSlate should be taken as investment advice. Buying and trading cryptocurrencies should be considered a high-risk activity. Please do your own diligence before making any investment decisions. CryptoSlate is not accountable, directly or indirectly, for any damage or loss incurred, alleged or otherwise, in connection to the use or reliance of any content you read on the site.
© 2025 CryptoSlate. All rights reserved. Terms & Conditions | Privacy Policy
Please add [email protected] to your email whitelist.
Stay connected 👇
