North Korea’s Crypto Theft Reaches $2.83B Since 2024

by

Hold onto your wallets, folks, because North Korea is apparently the latest crypto kingpin-stealing a jaw-dropping $2.83 billion in cryptocurrency between January 2024 and September 2025. 🚨💸 Yes, you read that right. While the rest of us are trying to keep track of our Venmo transactions, these hackers are out here doing real damage. 😬

To put this into perspective, that number is nearly one-third of North Korea’s total foreign currency income in 2024. So yeah, they’re basically turning crypto theft into an art form. 🎨💰

The Bybit Heist: A Masterclass in Cybercrime

According to the Multilateral Sanctions Monitoring Team (MSMT)-you know, the group of 11 countries keeping tabs on North Korea’s digital crime spree-crypto theft skyrocketed in 2025. These cyber-ninjas swiped a cool $1.64 billion in the first nine months of the year alone. And no, that’s not a typo. That’s a 50% increase from the previous year. 📈💀

But wait, let’s talk about the crown jewel of this operation: The Bybit hack. In February, the infamous TraderTraitor group, also known as Jade Sleet or UNC4899, launched a cyberattack that made the Ocean’s Eleven crew look like amateurs. They used phishing emails (classic!) and malware to break into SafeWallet, a provider for Bybit. Then, they pulled off the equivalent of a magic trick-making their stolen funds look like internal transfers so no one would notice. Ta-da! 💻✨

North Korea’s hackers are smart, too. Instead of going after exchanges directly (like the rest of us would), they target third-party service providers-like SafeWallet-because, you know, why play fair? This year alone, they’ve used fake developer profiles, stolen identities, and even hacked into supply chains. Oh, and did I mention they also managed to steal $63 million from Munchables? The money was later returned, but apparently, they had some issues laundering it. I mean, come on, even hackers need a lesson in money laundering 101. 🤦‍♀️

Hackers’ Guide to Laundering Crypto: Step-by-Step

So, how do they clean up all that stolen crypto, you ask? Well, hold onto your hats. The process takes a wild nine steps, starting with swapping stolen assets for Ethereum (ETH), followed by some well-timed mixing services like Tornado Cash and Wasabi Wallet. Then they convert it to Bitcoin (BTC), mix it again, hide it in cold wallets, and finally trade it for Tron (TRX) and USDT. If this sounds like a game of Monopoly, that’s because it’s probably more complicated than your last family game night. 🎲💸

And who’s helping them? Oh, just some shady brokers and companies in China, Russia, and Cambodia. China’s Ye Dinrong and Tan Yongzhi, along with Russian brokers (hello, $60 million conversion), have all been identified as players in this game. And Cambodia? Well, they’ve got Huione Pay moving the stolen funds around like it’s no big deal. But don’t worry-they totally didn’t get their license renewed by the central bank. Oops. 😬

The MSMT also reports that North Korea has been buddying up with Russian-speaking cybercriminals since the 2010s. So in 2025, the hackers linked to Moonstone Sleet were using tools leased from a Russian group called Qilin. So yeah, it’s basically a global operation at this point. 🌍

In case you were wondering, the MSMT is taking this very seriously. They’ve issued a joint statement urging UN member countries to raise awareness about these cyber activities. They’re also pushing for the UN Security Council to restore its Panel of Experts. In other words, these hackers are on notice-and the world is watching. 👀

Read More

2025-10-26 00:52