North Korea Accused of Stealing an Estimated $2.8 Billion in Cryptocurrency Since Early 2024

A new report by the Multilateral Sanctions Monitoring Team (MSMT), supported by the United Nations member states, alleges that North Korea has stolen at least US $2.8 billion in cryptocurrency since early 2024 — amounting to around one-third of the country’s total foreign-exchange revenue for the year.

Key Findings

• The analysis, conducted with backing from security firms Chainalysis and Mandiant, holds Pyongyang responsible for major crypto-heists, including:

  • A February 2025 attack on Bybit valued at approximately US $1.46 billion.

  • The compromise of DMM Bitcoin (≈ US $308 million) and WazirX (≈ US $235 million).

  • Attacks on DeFi platforms such as PlayDapp (≈ US $290 million) and Radiant Capital (≈ US $50 million).

• However, experts caution that attribution may be over-stated: security analyst Taylor Monahan argues that some attacks reportedly linked to North Korea, such as one on BTCTurk in 2024, were in fact perpetrated by Russian actors.

Implications & Broader Context

The findings raise important issues for global crypto regulation, national security and sanctions enforcement:

• Sanctions evasion and foreign-exchange revenue: The report suggests that North Korea is using crypto heists as a tool to generate hard currency in the face of international sanctions. If accurate, the US $2.8 billion figure represents a significant revenue stream tied to illicit digital asset activity.

• Attribution challenges in cyber-heists: The fact that some attacks may be misattributed highlights the difficulty of publicly assigning responsibility in blockchain-based crimes — especially when actors obfuscate origins or purpose.

• DeFi and exchange vulnerabilities: With platforms such as PlayDapp and Radiant Capital targeted, the report underscores how decentralized finance systems and crypto exchanges remain attractive to advanced threat actors.

• Need for stronger regulations and security practices: The scale of these alleged thefts may prompt regulators and platform operators to enhance due-diligence, forensic tracking and international cooperation in crypto crime investigations.

Cautions & Considerations

While the report offers alarming figures, some caveats are worth noting:

• The total amount “at least US $2.8 billion” is likely a minimum estimate; actual figures may vary upward or downward depending on attribution, recovery and hidden flows.

• Attribution to North Korea remains contested in some cases; mis-assignment can distort both policy responses and public understanding.

• Crypto­thefts are only part of the broader illicit finance ecosystem; traditional money-laundering, trade-based schemes and sanctioned commodity flows also matter in the sanctions-evading context.

Looking Ahead

For investors, policymakers and crypto platform operators, the report serves as a wake-up call: large-scale thefts tied to state-linked actors are no longer theoretical. In response, stakeholders may want to focus on:

• Rigorous monitoring of outbound wallet flows and layering patterns associated with known high-risk jurisdictions.

• Enhanced exchange/DeFi security measures, including cold-storage best practices, wallet-whitelisting, and proactive threat-intelligence sharing.

• Regulatory collaboration across borders to trace stolen funds, freeze assets, and hold facilitators accountable.

• Investor education: awareness that crypto markets, while offering opportunities, also carry higher risk of state-sponsored cyber-crime.

Conclusion
The MSMT report’s finding that North Korea may have stolen US $2.8 billion in cryptocurrency since 2024 is a stark reminder of how digital assets are increasingly woven into global illicit finance and state-level financial operations. While attribution remains complex and numbers may be refined, the message is clear: crypto crime is no longer just a fringe issue — it is a component of geopolitical finance, sanctions evasion and cyber-enabled economic strategy. As the crypto ecosystem continues to mature, vigilance, transparency and cooperation will be critical if the industry is to outpace the threats it faces.