Record Crypto Theft in H1 2025

Hackers have stolen $2.1 billion in crypto, a record high in the first half of 2025, with North Korean-sponsored actors accounting for 70% of the losses, according to a report released Friday by blockchain intelligence provider TRM Labs.

The total amount stolen was 10% more than the previous high set in 2022. The report, titled “H1 2025 Crypto Hacks and Exploits: A New Record Amid Evolving Threats,” noted that North Korean groups were allegedly responsible for $1.6 billion of the stolen crypto.

TRM stated that North Korea has solidified its position as the most prolific nation-state threat actor in the crypto space.

> TRM Labs analysis shows #crypto hackers stole over USD 2.1B in H1 2025 — the largest six-month total on record. Nearly 70% came from the USD 1.5B Bybit hack, attributed to North Korea.
>
> Read the full breakdown 👉 TRM Labs
>
> — TRM Labs (@trmlabs) June 27, 2025

The report explained that these thefts serve as a critical tool of statecraft for North Korea.

The staggering total in 2025 was driven by the February theft of Ethereum and related assets from crypto exchange Bybit, amounting to nearly $1.5 billion—the largest hack in the history of the crypto industry.

The multi-signature wallet provider Safe indicated that the heist resulted from a compromised developer laptop. An investigation revealed that a high-level Safe developer’s workstation was infiltrated on February 4 when it interacted with a malicious docker project, a lightweight application.

Authorities have blamed North Korean hackers for the breach of the Dubai-based exchange, and TRM Labs corroborated these allegations.

>The February 2025 Bybit breach… reshaped the narrative for the year, inflating average hack size and underscoring the strategic use of cybercrime by nation-states.

U.S. authorities have consistently claimed that North Korea’s heavily sanctioned regime utilizes hackers to steal crypto to fund its nuclear program. Major crypto hacks have frequently been traced back to this nation, led by dictator Kim Jong Un.

TRM Labs concluded that crypto hacks are increasingly viewed as symbolic or strategic rather than simply financially motivated. This highlights a shift in how cybercrime in the crypto space is utilized as a weapon.

Edited by James Rubin