State-Sponsored Crypto Theft

It started with North Korea's Reconnaissance General Bureau, whose hackers (the Lazarus Group) took $81 million from Bangladesh Bank via SWIFT in February 2016 and then turned to South Korean crypto exchanges such as Youbit in 2017, the first notorious state crypto heists.

This method has one well-documented state actor: North Korea. Hacking units the US and UN attribute to its Reconnaissance General Bureau (tracked as the Lazarus Group, APT38 and 'TraderTraitor') first stole from banks, most notably the $81 million taken from Bangladesh Bank via SWIFT messages in 2016. From 2017 they turned to cryptocurrency exchanges in South Korea and elsewhere, then to crypto bridges, wallets and trading firms. Each year's haul has tended to set records, peaking with the roughly $1.5 billion Bybit theft in February 2025. The UN Panel of Experts has reported that the proceeds help fund the country's weapons programmes.

Attackers usually go after people, not code: they pose as recruiters or business contacts and send a fake job test, document or trading app that installs malware. Once inside, they steal the keys or sign-in sessions that control a company's wallets, or trick staff into approving a disguised transaction. The stolen coins are moved quickly through many wallets, swap services and mixers, often converted to bitcoin, and finally cashed out through brokers. Individuals are mainly at risk through fake job offers and fake remote IT workers.

For a sanctioned state it is close to ideal: a few hundred trained hackers, cheap phishing and fake-job lures, no physical cash to move, and proceeds that the UN Panel of Experts says fund weapons programmes. Success rates are high because targets are lightly regulated exchanges and bridges; Chainalysis attributed a record $2.02 billion to North Korea in 2025, about 60% of all crypto stolen that year. Prosecution is effectively impossible: the US has indicted named operators such as Park Jin Hyok since 2018, but none has been arrested, and only launderers like Ghaleb Alaumary have been jailed.

Chainalysis estimates North Korean hackers have stolen at least $6.75 billion in crypto all time, with $2.02 billion in 2025 alone (Chainalysis, Dec 2025). The biggest single case is the roughly $1.5 billion Bybit theft of February 2025, the largest crypto theft on record (FBI, 26 Feb 2025). The non-money harm is strategic: the UN Panel of Experts reported the proceeds fund North Korea's nuclear and missile programmes, and exchanges such as Youbit went bankrupt after being hit.