North Korea’s reach in the world of crypto crime is growing fast. Last year, the regime’s hackers took $1.34 billion in digital assets, more than every other group put together.
That figure alone made up 61% of all crypto theft in 2024, based on data from Chainalysis. But it’s not just the size of the thefts that is important.
Their methods are getting sharper. And while North Korea remains the biggest name in the game, it’s now part of a wider, darker ecosystem.
North Korea’s Attacks Are Getting Sharper…
In 2024, hacks specific to North Korea happened roughly once every 11 days. That’s quicker than the 13-day pace seen in 2023, per Chainalysis.
Most of these breaches came down to private key theft, a tactic that helped drive North Korea’s total share to nearly 61% of all stolen crypto value last year.
Once stolen, the crypto is usually moved through mixers like Sinbad or obscure bridges. About $147 million was laundered through Sinbad alone in 2024. After Tornado Cash got sanctioned, North Korea’s laundering ops didn’t slow.
Lazarus Allegedly Hit Bybit for $1.5B But There’s Crime Beyond North Korea
Some breaches weren’t part of the Chainalysis breakdown. In early 2025, Lazarus, a North Korean cyber unit with known ties to state operations, allegedly drained $1.5 billion worth of ETH from Bybit. The exploit came through a vulnerable multisig bridge setup.
North Korea may be ahead in scale, but others are close behind. Chainalysis’ report says crypto scams brought in $9.9 billion last year.
The tactics have moved beyond basic tricks. Now, its fake profiles powered by AI, deepfake video calls, and long-game romance or investment scams.
These aren’t clumsy one-off attempts. Scammers are using full identity kits, fake apps that look real, and websites made to feel like actual trading platforms.
DeFi isn’t doing much better.
Chainalysis estimates that over $2.5 billion in trading volume last year was fake, mostly generated by bots running wash trades.
Tools like Volume.li were used to make it look like real demand. Nearly 4% of new tokens launched in 2024 showed signs of pump-and-dump activity. Most barely lasted a day before the insiders cashed out.
What About the Darknet?
Darknet markets are still in business. After AlphaBay went quiet, Abacus Market picked up speed, growing over 180% year-on-year.
What’s changed is how the business runs. Chinese vendors are now selling everything from pill presses to chemical kits for synthetic opioids.
Payments? Mostly in Monero or stablecoins. Some of these drugs, according to on-chain traces, were labeled “20x stronger than fentanyl” and landed in Europe and the U.S.
On the laundering side, groups like Huione Guarantee have quietly become essential middlemen. Chainalysis says they’ve processed more than $70 billion in crypto since 2021.
These aren’t fly-by-night operations. They run full-fledged services, helping bad actors move money, hold fake escrows, and even deal with buyers under sanctions. It’s a network that keeps the wheels turning.
Crypto Crime Now Runs Deeper Than North Korea
North Korea may be leading in stolen volume, but it’s operating inside a much larger system. Chainalysis reports that the funds still support weapons development, espionage, and sanctions evasion.
At the same time, scam vendors, laundering services, and darknet markets continue to grow.The tools behind crypto crime are more accessible now, and the actors using them are adapting quickly.
