North Korea Stole $2.83–2.84B in Crypto, Funds Weapons

Multinational monitoring teams report North Korean state-sponsored cyber groups stole roughly $2.83–2.84 billion in virtual assets from January 2024 through September/October 2025, with thefts accelerating in 2025. The operations are attributed to outfits tied to the Reconnaissance General Bureau — including TraderTraitor, Lazarus, Kimsuky and Andariel — that use supply-chain attacks, phishing/social engineering, malicious code and wallet compromises to target third-party custody providers and exchanges. The February 2025 Bybit breach, linked to TraderTraitor and accounting for about half the total, and the infiltration of Japan’s DMM Bitcoin, which lost about $308 million and closed, are cited as major incidents. Stolen assets are laundered through multi-step chains and brokers in China, Russia, Hong Kong and Cambodia, aided by fake identities, job-interview ruses, AI tools and overseas North Korean IT operatives. Analysts say the proceeds are converted into fiat to finance sanctioned weapons programs and to evade international sanctions.