The global cryptocurrency industry lost more than $3.4 billion to theft in 2025, with North Korea-linked actors responsible for the majority of the stolen funds, according to Chainalysis’ latest Crypto Crime Report.
- The global cryptocurrency industry lost $3.4 billion to theft in 2025, with North Korean actors responsible for a significant portion.
- Africa’s rapidly expanding crypto adoption faces risks due to lack of regulatory oversight and security awareness.
- North Korea executed strategic crypto thefts, accounting for up to $2.02 billion in 2025 alone.
- Personal wallet attacks surged, particularly affecting self-custromy users in regions like Africa.
While the figures are global, their implications are increasingly Africa-centric, as crypto adoption expands rapidly across the continent, driven by remittances, currency instability, and financial exclusion.
Chainalysis estimates that North Korea accounted for between 59% and 76% of all major crypto thefts during the year, stealing at least $2.02 billion in 2025 alone.
This pushed the country’s cumulative haul from crypto crime to an estimated $6.75 billion, making it the most significant nation-state threat to the digital asset ecosystem.
According to Andrew Fierman, head of national security intelligence at Chainalysis. “North Korea’s sophistication and efficacy in laundering the proceeds from these incidents is continuing to improve,”
The report comes at a time when investing in crypto has become mainstream. More people own crypto, and because transactions are irreversible, individuals and exchanges are increasingly becoming targets.
“If you’re online, talking about your success in crypto investments, I’d recommend not doing that,” Fierman added. “It points to you potentially having a hardware wallet and creates a physical target for you as an individual.”
North Korea Emerges as the Dominant Crypto Threat Actor
Unlike typical cybercriminal groups, North Korean hackers operate with strategic patience, executing fewer attacks but extracting far larger sums.
In 2025, their operations accounted for a record share of service-level breaches, underlining the growing role of nation-state actors in crypto crime.
The country’s record-breaking 2025 performance, achieved with 74% fewer known attacks, suggests we may be seeing only the most visible portion of its activities.
The Bybit Hack and the Rise of Mega-Scale Breaches
The scale of the threat was illustrated in February, when Dubai-based exchange Bybit suffered a $1.4–$1.5 billion breach, the largest crypto hack on record.
That single incident accounted for roughly 40% of all crypto stolen globally in 2025. Chainalysis found that just three major hacks accounted for more than two-thirds of all stolen crypto, highlighting a shift towards fewer but far more devastating breaches.
Personal Wallet Attacks Surge as Retail Users Bear the Risk
Beyond high-profile exchange hacks, the report points to a sharp rise in personal wallet compromises, particularly relevant for Africa.
Personal wallet compromises have also grown substantially, increasing from 7.3% of total stolen value in 2022 to 44% in 2024, and would have been 37% in 2025 if not for the outsized impact of the Bybit attack.
Chainalysis recorded 158,000 individual wallet attacks in 2025, nearly triple the number seen in 2022.
These attacks rely heavily on social engineering, including phishing emails, fake investment messages, and impersonation scams.
For African users, many of whom self-custody assets through mobile wallets and peer-to-peer platforms, such attacks present a growing vulnerability.
Why Africa Is Increasingly Exposed
Africa is one of the fastest-growing crypto markets globally, with Nigeria, Kenya, South Africa, and Ghana among the most active peer-to-peer trading hubs. Crypto is widely used for cross-border payments, freelance income, and hedging against inflation.
However, regulatory oversight, consumer protection, and cybersecurity awareness remain uneven, making the continent a potential target for sophisticated cybercriminals.
Inside the Tactics: Infiltration, Impersonation, and Deception
North Korean hackers have refined their methods by embedding fake IT workers inside crypto exchanges, custodians, and Web3 firms.
Using stolen identities and AI-assisted tools, they secure remote roles, gain privileged access, and quietly enable large-scale thefts.
More recently, they have impersonated recruiters and investors, staging fake hiring processes or partnership talks to harvest credentials and internal systems access, an evolution that extends earlier infiltration tactics.
A Growing Test for Africa’s Crypto Future
For African regulators, platforms, and users, the warning is clear. As crypto fills gaps left by traditional finance, security and education must advance at the same pace.
Without stronger safeguards, the same technologies expanding financial access across the continent risk becoming new entry points for global cybercrime networks operating, as Chainalysis notes, by “very different rules than typical criminals.”
The challenge for 2026 will be detecting and preventing high-impact operations before DPRK-affiliated actors inflict another Bybit-scale incident.
