Last year, the crypto world lost over $3.4 billion to cyber theft. North Korea-linked people were behind most of it. This matters for Africa, where crypto use is rising but security is lacking.
A new report from Chainalysis says North Korean hackers carried out major, planned attacks and stole about $2.02 billion. These attacks occurred worldwide and highlight how unprotected new markets, such as Africa’s fast-growing crypto scene, are.
Chainalysis estimates that North Korea was behind 59% to 76% of the largest crypto thefts in 2025, bringing its total from crypto crimes to about $6.75 billion. Experts say this makes North Korea the world’s biggest government threat to digital money.
Andrew Fierman, who oversees national security intelligence at Chainalysis, said North Korea is getting better at hiding the money it steals.
This report comes as more people use cryptocurrency. Since transactions can’t be undone, regular users and exchanges are valuable targets. Fierman also said talking about your crypto online makes you a target, especially if you use a hardware wallet.
Unlike regular cybercriminals, North Korean hackers are patient and careful. They carry out fewer attacks but steal much more money. In 2025, they were behind a record number of major breaches, showing governments play a bigger role in crypto crime.
One example was when the Dubai-based exchange Bybit was hacked in February and lost $1.4–$1.5 billion, the biggest crypto hack ever. It accounted for about 40% of all crypto theft last year. Just three major hacks accounted for over two-thirds of all money stolen, suggesting fewer but larger attacks.
Attacks on Personal Wallets Are Up
Besides exchange hacks, attacks on personal wallets increased sharply, especially for users in Africa. These attacks use fake emails, investment offers, and scams. They rose from 7.3% of all money stolen in 2022 to about 37% in 2025. Chainalysis counted 158,000 attacks on individual wallets last year, almost three times more than in 2022.
For people in Africa, who often keep crypto in mobile wallets or use peer-to-peer platforms, these attacks are a serious and growing problem.
Africa is one of the fastest-growing crypto markets, with Nigeria, Kenya, South Africa, and Ghana becoming important trading spots. People increasingly use crypto for cross-border payments, freelance work, and to protect against inflation.
Because there are not always strong rules, people lack protection, and cybersecurity awareness is low, Africa is a target for cybercriminals. The North Korean attacks show Africa needs better security and education to protect users.
How North Korea Does It
North Korean hackers are getting better at sneaking into crypto exchanges, custodians, and Web3 companies using fake IDs and AI tools. They gain access by pretending to be remote workers, then steal large sums of money. Recently, they have posed as recruiters and investors, setting up fake interviews or partnership talks to steal logins and access internal systems.
For regulators, platforms, and crypto users in Africa, the message is clear: as crypto becomes more common, it creates new ways for governments to commit cybercrime. Without stronger protections, the same tools that help people access money could also let in those who play by rules different from those of typical criminals, as Chainalysis says.
The challenge is to find and stop these large-scale attacks before North Korea pulls off another Bybit-sized heist. Africa’s crypto market needs to grow quickly, but it also needs strong security and rules to handle these new dangers.
