In February 2025, the globally renowned cryptocurrency exchange Bybit suffered a major attack, with its cold wallet assets being transferred in a short period, resulting in losses amounting to billions of dollars. U.S. investigative agencies subsequently determined that the theft was carried out by organizations linked to North Korea's Lazarus group, marking one of the largest single theft incidents in the cryptocurrency industry to date.

According to analyses from several security firms, the attack did not solely rely on technical vulnerabilities but combined social engineering, malware, and precise interference with operational links, allowing hackers to bypass multiple security mechanisms and successfully transfer cold wallet assets. This incident indicates that even top exchanges with robust security systems can be breached by state-level attack organizations if there are weak links in internal processes.

After stealing the assets, the hackers immediately initiated a multi-layered money laundering process: cross-chain transfers, using mixing tools, splitting funds into anonymous wallets, and then converting them into other asset classes or stablecoins, ultimately entering a hard-to-trace gray circulation network.

In recent years, international analytical agencies have continuously warned that North Korean-related organizations have developed a mature "steal coins - launder money - cross-border transfer" assembly line. With the proliferation of mixing services, cross-chain protocols, and anonymous trading tools, such funds are more easily able to penetrate regulatory oversight. Ultimately, some assets may be converted into fiat currency to evade sanctions or support sensitive national projects.

This has made North Korea's cryptocurrency theft not just a cybercrime issue but closely related to geopolitics, financial sanctions, and transnational law enforcement.

These attacks on large exchanges have challenged the security myth of the entire industry. What was once considered the most secure cold wallets, multi-signature, and custody structures are now precarious due to human factors, process vulnerabilities, or supply chain attacks. User trust in centralized platforms has rapidly declined, and panic spread at one point.

Regulatory pressure has also increased. Multiple countries have begun to demand enhanced on-chain monitoring, improved filtering capabilities for high-risk addresses on crypto platforms, and pushed for exchanges to publicly disclose asset structures and security processes. For compliance agencies, identifying stolen assets mixed into legitimate trading flows has become a new challenge.

At the same time, North Korean hackers have gradually expanded their targets from large exchanges to developers, small teams, and even ordinary users. By disguising themselves as recruitment, collaboration projects, or technical exchanges, they lure targets into downloading malware or executing dangerous signatures. As attack patterns diversify, the protective pressure on the entire industry has further increased.

International security research generally believes that harsh sanctions and financial blockades have made it extremely difficult for North Korea to obtain foreign exchange. The inherent characteristics of cryptocurrency assets, such as strong cross-border liquidity, difficulty in complete tracking, and ease of cashing out in gray markets, make them ideal tools for evading sanctions.

Compared to traditional smuggling, underground trading, or foreign exchange channels, cryptocurrency theft is more covert and high-yielding: once a large platform is breached, the scale of funds obtained is enormous, and they can be quickly dispersed and laundered through on-chain tools. For North Korea, this is a relatively low-cost, high-success-rate, and lucrative foreign exchange supplement channel that can bypass the global financial system.

Therefore, cryptocurrency theft has been regarded as an important "foreign exchange earning method" for the country, executed by specialized and organized hacker teams over the long term.

In the face of such large-scale, systematic state-level hacking activities, the cryptocurrency industry and regulatory systems are seeking new defense strategies:

Exchanges and custody institutions need to strengthen operational process security, including key management, multi-layer approval mechanisms, offline management systems, and internal permission monitoring, to avoid systemic losses due to single-point failures.

Enhance on-chain tracking capabilities, strengthen monitoring of high-risk addresses, mixing tools, and cross-chain flow paths, and establish a more comprehensive suspicious transaction reporting mechanism.

Promote international cooperation, including real-time intelligence sharing among law enforcement agencies, regulatory departments, and blockchain analysis companies, to improve the efficiency of freezing stolen assets.

Increase industry transparency by requiring platforms to disclose funding structures, security strategies, audit results, and major security incidents, reducing information asymmetry for external investors.

Enhance security awareness among developers and users, establishing an education system against phishing, social engineering, and malware, so that individuals are no longer the weak links in the attack chain.

As we enter 2025, the cryptocurrency industry has become acutely aware that state-level cyberattacks are becoming a new fundamental risk. The large-scale theft operations by North Korean hackers have not only shaken the industry's technical confidence but also challenged the global financial regulatory system. The future cryptocurrency ecosystem will no longer focus solely on innovation but will also need to confront security threats at the state level.

Between trust and risk, the industry must establish a more robust security baseline; users and project parties must also understand that in this new threat landscape, security and compliance are no longer "optional" but essential for survival.

Related: Solana (SOL) ETF attracted $369 million in November, with investors favoring yield-generating assets.

Original article: “North Korea's Crypto Theft Storm: How State-Supported Hackers are Shaking Global Crypto Trust”

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。