According to a report by the Multilateral Sanctions Monitoring Team (MSMT), North Korean hackers stole $2.83 billion in cryptocurrency assets between January 2024 and September 2025. This staggering amount funded nearly one-third of North Korea's total foreign currency income in 2024 alone.
The theft accelerated sharply in 2025, with $1.64 billion stolen in the first nine months, representing a 50% increase from the $1.19 billion taken in 2024. A major contributor was the February 2025 attack on the global cryptocurrency exchange Bybit, attributed to the North Korean hacking group TraderTraitor.
The hackers gained unauthorized access by targeting SafeWallet, the multi-signature wallet provider used by Bybit, through phishing emails and malware. They disguised external transfers as internal transactions to hijack control of the cold wallet's smart contract. The MSMT noted that North Korean hackers often avoid direct exchange attacks, instead focusing on third-party service providers.
The report detailed a complex nine-step laundering process: stolen assets are first swapped for Ethereum (ETH) on decentralized exchanges, then mixed using services like Tornado Cash and Wasabi Wallet. ETH is converted to Bitcoin (BTC) via bridge platforms, stored in cold wallets, and after further mixing, BTC is traded for Tron (TRX) and then converted into the stablecoin USDT. Finally, USDT is sent to Over-the-Counter (OTC) brokers in China, Russia, and Cambodia to be exchanged for fiat currency.
Specific individuals and companies were implicated, including Chinese nationals Ye Dinrong and Tan Yongzhi of Shenzhen Chain Element Network Technology, and Russian intermediaries who assisted in laundering approximately $60 million from the Bybit hack. Cambodia's Huione Pay was also used, with a North Korean national maintaining direct contact for cashing out assets, despite the company's license not being renewed by the National Bank of Cambodia.
SOL
XRP
MIM