What happened
CertiK published findings on Wednesday claiming that North Korean state-linked threat actors have moved billions of dollars worth of stolen cryptocurrency through laundering channels, and are now expanding beyond pure cyber intrusion into physical infiltration of crypto-native firms. Crypto Briefing first surfaced the report. The security firm did not name specific victim companies in the public summary, but it tied the activity to the broader DPRK cyber program that has been linked to Lazarus Group operations against exchanges and cross-chain bridges since at least 2022.
CertiK's framing is blunt: the laundering pipelines that washed funds from past hacks are still operational, and the human-side attack surface is widening. Crypto Briefing's writeup describes infiltration tactics that include placing operatives inside firms under fake identities, a pattern that has already drawn warnings this cycle from the US Treasury and South Korean authorities.
Why it matters
For years, the crypto industry treated DPRK exposure as a code problem. Audit the bridge, harden the multisig, sanction the mixer. CertiK's read is that the threat model now includes the person you just onboarded as a Solidity contractor.
That changes who owns the risk. It moves out of the security team's threat-intel queue and into HR, legal, and operations. The billions figure also matters because it directly contradicts the narrative that sanctions, mixer takedowns, and stablecoin issuer freezes have throttled DPRK monetization.
They've slowed it. They haven't stopped it. If a state actor can still cash out at scale and is now expanding the attack surface, every firm holding customer assets has to revisit assumptions about insider threat that the industry has been quietly skipping.