North Korea-linked hacking groups were responsible for about two-thirds of global virtual-asset hacking losses during the first half of 2026 [1].
The scale of these thefts indicates a sophisticated, state-sponsored effort to bypass international sanctions and secure hard currency through the exploitation of cryptocurrency markets.
According to reports citing TRM Labs, these groups, which are linked to the country's military intelligence agency, dominated the landscape of virtual-asset theft from January through June of this year [1]. The total value of virtual currency stolen by these entities in the first half of 2026 is estimated at approximately 1 trillion KRW [3].
This trend follows a pattern of aggressive cyber activity targeting financial infrastructure. Previous data shows that North Korea-linked hackers stole $2.83 billion in virtual assets between 2024 and September 2025 [2]. The persistence of these attacks suggests a highly organized operation aimed at maximizing illicit revenue streams.
Security analysts said that these groups often employ diverse tactics to breach security. In May of this year, reports indicated that North Korean hacking groups utilized spear-phishing attacks to target security and policy figures [4]. Such targeted campaigns allow attackers to gain high-level access to sensitive systems before deploying theft mechanisms.
Virtual-asset markets remain a primary target due to the relative anonymity and speed of transactions. The concentration of losses attributed to a single state-linked entity highlights a significant vulnerability in the global digital asset ecosystem—one that continues to be exploited by the military intelligence apparatus of North Korea [1].
“North Korea-linked hacking groups were responsible for about two-thirds of global virtual-asset hacking losses”
The dominance of North Korean actors in cryptocurrency theft suggests that the regime has successfully pivoted its intelligence capabilities toward financial warfare. By capturing a majority of global crypto losses, the state can fund its domestic programs and military development despite heavy international sanctions, effectively turning the decentralized nature of blockchain technology into a strategic state asset.
