Crypto
North Korean hackers allegedly stole record $2.02 billion of cryptocurrency in 2025. Here’s how they did it | Stock Market News
North Korea remains dominant threat to cryptocurrency security in 2025, even while confirmed incidents have decreased, according to a report by blockchain analytics company Chainanlysis.
Hackers from the Democratic People’s Republic of Korea (DPRK) allegedly stole a record $2.02 billion of crypto this year — a 51% jump compared to 2024, and taking their all-time total to $6.75 billion, it added.
The analysis further found that the DRPK is achieving larger thefts with fewer incidents, using unique methods to gain access and pull off their heists.
North Korea’s alleged crypto heists: Here’s how they did it
As per the report, these hacks were often carried out in unique fashion by embedding IT workers inside crypto services or using sophisticated impersonation tactics targeting executives.
Embedding IT workers
This is among the DPRK’s “principal attack vectors”, the report said. It added that the hackers secured jobs inside crypto services to gain privileged access and enable high‑impact compromises.
“Part of this record year likely reflects an expanded reliance on IT worker infiltration at exchanges, custodians, and web3 firms, which can accelerate initial access and lateral movement ahead of large‑scale theft,” it noted.
Fake jobs
Further, taking the IT worker model and “flipping it on its head”, the analysis said that DPRK-linked operators are also increasingly impersonating recruiters for prominent web3 and AI firms. This way, they orchestrate fake hiring processes that culminate in “technical screens” designed to harvest credentials, source code, and VPN or SSO access to the victim’s current employer.
“At the executive level, a similar social‑engineering playbook appears in the form of bogus outreach from purported strategic investors or acquirers, who use pitch meetings and pseudo–due diligence to probe for sensitive systems information and potential access paths into high‑value infrastructure,” it added.
Higher- value attacks
Over the years, DPRK-linked operators are increasingly undertaking significantly higher-value attacks compared to other threat actors. “This pattern reinforces that when North Korean hackers strike, they target large services and aim for maximum impact,” the report added.
It noted that “this year’s record haul came from significantly fewer known incidents”, including the massive $1.5 billion Bybit hack in February 2025.
DPRK’s distinctive laundering patterns
Not just the hacking process, the laundering of stolen funds is also distinctive, the report said. It noted that more than 60% of laundering was of volume concentrated below $5,00,000 transfer value tranches, despite the total stolen amounts being larger.
“Even while the DPRK consistently steals larger amounts than other stolen fund threat actors, they structure on-chain payments in smaller tranches, speaking to the sophistication of their laundering,” it added.
Key Takeaways
- Stack’s Bowers Galleries auctions a funded Casascius 0.5 BTC token graded MS-66 on June 18, 2026.
- Only 15 Casascius coins exist at MS-66, with 11 graded finer, tightening supply for collectors.
- Stack’s Bowers’ 120-lot crypto sale tops $500K intrinsic value, including Topps Allen and Ginter crypto cards.
What’s Being Sold
According to the Stack’s Bowers Galleries announcement shared with Bitcoin.com News, the token is graded MS-66 by the Professional Coin Grading Service (PCGS). Only 15 examples exist at that grade. Just 11 coins have been graded finer, all at MS-67. The token remains funded, meaning the 0.5 BTC loaded onto the blockchain at creation is still intact and redeemable.
The coin was produced by Mike Caldwell, a Utah-based software engineer who began minting the Casascius series in 2011. Each physical coin holds a private key beneath a tamper-evident hologram, with real bitcoin loaded onchain at the time of minting.
Why Casascius Coins Are Scarce
Caldwell halted production after regulators flagged the operation as a potential unlicensed money transmission business in 2013. The short production window left a finite supply. Attrition has narrowed that supply further: some owners have “peeled” their coins to claim the bitcoin, destroying the collectible and erasing its numismatic value in the process. Funded examples in high grades are now rare by any measure.
The Auction Context
The June 18 sale is not a one-lot showcase. Stack’s Bowers has assembled more than 120 crypto collectibles with a combined intrinsic value exceeding $500,000. The sale includes coins from the Casascius, BTCC, and Lealana series, alongside lower-mintage modern issues from producers including Mybits, Satori, Denarium, Ballet, and Freedom Bitcoin.
The auction also marks the firm’s first offering of crypto trading cards from Topps’ Allen and Ginter series, a crossover expected to draw interest from sports card collectors who track that product line separately from the crypto space.
Early Bitcoin Magazine issues round out the sale, including a copy of Issue No. 1 and a consecutive run of Issues 9 through 15.
Who’s Behind the Gavel
Stack’s Bowers Galleries has operated for more than 90 years and is a wholly owned subsidiary of A-Mark Precious Metals Inc. (Nasdaq: AMRK), which acquired parent company Spectrum Group International in early 2025 for $92 million. The firm is a PCGS Authorized Dealer, a member of the Professional Numismatists Guild, and the official auctioneer for major numismatic events, including ANA World’s Fair of Money conventions.
“American coinage and commerce have always been a mirror to the nation’s journey toward liberty and success,” James McCartney, Director of Numismatics at Stack’s Bowers Galleries, remarked.
The Stack’s Bowers Galleries executive added:
“There is no greater context in which to offer this historic Fourth of July funded 0.5 bitcoin.”
What Buyers Should Know
Bidders should account for buyer’s premiums, which typically run above 20% at premium auction houses. The token’s collectible value operates separately from its bitcoin spot value, and both factors are relevant to the final price. The auction is open for bidding through the Stack’s Bowers platform.
The firm is also accepting consignments for its Summer 2026 Global Showcase Auction, which will hold in-person previews at the ANA World’s Fair of Money in Pittsburgh, Pennsylvania. Specialists will also be available at the FUN Show in Orlando, Florida, running July 9 through 11.
With America’s 250th anniversary two weeks out and bitcoin trading actively, the timing places a 13-year-old physical token at an intersection that few collectibles have occupied before. Whether that intersection holds lasting value is a question the market will answer on Thursday.
Key Takeaways
A $13 Billion Wipeout in Days
Binance Research reported that April’s decentralized finance ( DeFi) exploits triggered around $13 billion in outflows, draining total value locked (TVL) across lending markets and decentralized exchanges. The flight pushed the onchain leverage ratio to about 38%, a reading the firm said marks a return to 2021 levels all while showcasing a massive decline in investor confidence.
The outflows can largely be traced back to a cluster of attacks, the largest of which struck liquid- staking protocol KelpDAO. Bitcoin.com News reported that KelpDAO had slammed Layerzero after a roughly $300 million exploit, later shifting its rsETH token to Chainlink’s cross-chain protocol, CCIP, in response.
The breach also rattled the wider ecosystem with lending protocol Aave battling a withdrawal crisis as depositors rushed for the exits. Confidence cracked further when Aave suffered a 44% monthly drop in value locked and outflows spread to neighboring protocols.
The attack’s mechanics unearthed a growing cross-chain threat with Layerzero, most recently, disclosing a remote procedure call (RPC) poisoning incident linked to the $292 million KelpDAO hack, in which attackers corrupted the data feeding the bridge’s verification network.
A Record Month for Hacks
April stood out even in a sector accustomed to breaches as industry trackers counted more than 20 separate exploits during the month, making it one of the most-hacked stretches on record. Aave alone saw billions in deposits exit within 48 hours, and several protocols paused certain operations as trust eroded.
Even then, the sector has shown resilience, with several protocols migrating cross-chain messaging to alternative providers and tightening verification. Binance Research and other analysts have argued that DeFi is evolving, citing the speed at which liquidity has historically returned as confidence has stabilized.
The 38% leverage reading is the figure to watch next, given that a return toward 2021 levels could mean the system has deleveraged sharply (potentially reducing the risk of forced liquidations and signaling diminished risk appetite). In any case, whether deposits rebuild from here will determine if April marked a temporary shock or a longer reset for onchain finance.
He said the Financial Crimes Unit is hard at work tracking the fraudsters, shutting down their websites, and hoping to bring them to justice.
There are various types of “pig butchering” scams, according to the federal government. They slowly play on the investor’s emotions and hopes.
“It is a type of confidence and investment fraud in which the victim is gradually lured into making increasing monetary contributions, generally in the form of cryptocurrency,” says the Office of Inspector General’s website, “to a seemingly sound investment before the scammer disappears with the contributed monies.”
If you are a victim of a scam, Becker said, contact your local police department. More information about that is here.
RELATED: Grandma Conned Into Mailing $10K Cash To Teaneck In ‘Grandparent Scam’
-
World2 minutes agoAnti-G7 protest turns violent as demonstrators torch Tesla and smash UN office windows
-
Politics9 minutes agoDems pick potential successor to DC’s congressional delegate after decades-long incumbency
-
Health12 minutes agoBride in full wedding gown makes 2-hour hospital trip to see her mother before the ceremony
-
Sports17 minutes agoBest Of World Cup: Top Fan Moments, From Cape Verde’s Goats To Mexico’s Duck
-
Technology24 minutes agoNew wheeled robot says no thanks to humanoid hype
-
Business27 minutes agoCapital Group buys Bunker Hill skyscraper
-
Entertainment32 minutes agoRapper Mystikal has been sentenced to 20 years in prison for rape: ‘I deserve the max’
-
Politics42 minutes agoNewsom seeks political advantage in probe he says Trump ordered
