What happened
AMBCrypto reported on Friday that North Korea-linked crypto thefts hit roughly $2 billion in 2025, a 51% increase year over year. The reporting attributes the bulk of the activity to the Lazarus Group, the DPRK's most prolific cyber unit, alongside a constellation of affiliated crews that have been tracked by Western blockchain forensics firms since the 2022 Ronin Bridge hit. The shift this year, per the report, is one of strategy rather than scale of personnel.
Lazarus is picking fewer fights and going after bigger purses: cross-chain bridges, institutional custodians, and exchange hot wallets where a single successful intrusion clears nine figures. That tracks with what TRM Labs and Chainalysis flagged in their first-half memos, when single-incident losses started averaging higher even as the total event count fell.
Why it matters
$2 billion is not a rounding error in this industry. It's roughly a third of the entire reported crypto theft volume for the year and it funnels directly into a sanctioned weapons program, which is why U. S.
Treasury's OFAC and South Korea's FIU have been escalating designations against mixers and OTC desks accused of laundering DPRK proceeds. The headline matters now because it lands in the middle of a policy window. The SEC is finalizing custody rules for spot ETF issuers, the EU's MiCA regime is six months into enforcement, and the U.
S. Treasury is weighing a fresh sanctions package targeting privacy tools. A confirmed $2B figure hands regulators a clean justification for tighter custody standards and harder constraints on cross-chain bridges, the exact rails Lazarus has been hitting.