North Korean hackers increasingly targeting wealthy crypto holders

Targeting high net worth crypto holders has helped North Korean hackers steal more than $2bn (£1.49bn) so far this year according to researchers.

The thefts are a record for the regime-linked hackers who now account for around 13% of North Korea's gross domestic product (GDP), according to United Nations' estimates.

For the last few years operatives from hacking teams like Lazarus Group have focussed on attacking cryptocurrency companies for large thefts of digital tokens.

But investigators at research firm Elliptic warn that crypto wealthy individuals have become increasingly attractive targets as they often lack the security measures employed by businesses.

Western security agencies say stolen funds are used to finance North Korea's nuclear weapons and missile development programs.

Dr Tom Robinson, chief scientist at Elliptic, says the targeting of individuals - which is less likely to be disclosed - means the true figure for hacks carried out by North Korea could be even higher.

"Other thefts are likely unreported and remain unknown as attributing cyber thefts to North Korea is not an exact science."

"We are aware of many other thefts that share some of the hallmarks of North Korea-linked activity but lack sufficient evidence to be definitively attributed," he says.

North Korea's UK embassy was approached for comment but did not immediately respond. Previously the regime has denied any involvement in hacks.

Elliptic and other companies like Chainalysis are able to track the movement of stolen funds like Bitcoin and Ethereum by following the public list of transactions on the blockchain.

Over the years researchers have noticed patterns in methods and tools favoured by North Korean hackers.

Elliptic estimates that 2025's bumper year so far takes the cumulative known value of cryptoassets stolen by the regime to more than $6bn.

North Korea does not disclose GDP figures but the UN estimates that in 2024 the country made