North Korean Hackers Stole $2 Billion in 2025, Targeting US Financial Firms

A new CrowdStrike report reveals that North Korean cyber operatives stole a record $2.02 billion in digital assets in 2025, marking a 51% year-over-year increase. This surge was driven largely by a massive $1.46 billion heist from the crypto exchange Bybit, executed by compromising a third-party developer’s credentials. The stolen funds are believed to support Pyongyang’s military and nuclear weapons programs. Following this success, DPRK-linked hackers have intensified their focus on the financial services sector, which has risen to become the fourth most-targeted industry globally. A primary tactic involves North Korean IT workers posing as American job seekers to secure remote positions at Western companies. These operatives often collaborate with American accomplices who operate "laptop farms" to mask their identities and funnel salaries back to the regime. Recent law enforcement actions include the sentencing of two US nationals for facilitating these schemes, highlighting the growing threat of state-sponsored intrusion against financial institutions and consumer banks in North America and beyond.