CertiK: DPRK hackers drive 60% of 2025 crypto theft

Published: 2026-05-14 18:36:27 |

CertiK’s Skynet DPRK Crypto Threats Report says DPRK hackers were behind about $2.06B of the $3.4B total crypto losses from hacks in 2025—60% of losses but only 12% of incidents. Since 2016, DPRK-linked actors have stolen about $6.75B across 263 attacks, and 2026 is already at roughly $620.9M of losses, led by a $291M KelpDAO exploit. A key shift is “physical infiltration”: DPRK operators reportedly embed as employees/contractors to gain insider access, alongside social engineering and supply-chain tactics. CertiK also highlights fast laundering—for the Bybit hack, 86% of stolen ETH was converted to BTC within a month via mixers and exchanges, reducing recovery chances. For traders, this is a risk signal for DeFi protocol security and liquidity. Major DPRK-linked hack headlines can raise near-term volatility and push token risk premiums higher, especially for higher-beta assets. Over the long run, the “inside access + rapid laundering” pattern supports a more cautious stance, with continued operational-security and monitoring upgrades needed as the threat persists.

Bearish

DPRK hackers appear to be scaling both the scale and the effectiveness of crypto thefts. The report links DPRK activity to a majority of 2025 losses and shows 2026 losses already running high, including large DeFi-related exploits (e.g., KelpDAO). The “physical infiltration” theme implies higher odds of compromised insiders, which can worsen sentiment and raise perceived tail-risk for DeFi liquidity. Short-term, traders may rotate away from higher-risk DeFi exposure as hack-risk headlines and incident risk premiums rise. The noted laundering speed (fast ETH→BTC conversions) can also reduce confidence in recovery, increasing the probability that markets reprice affected tokens downward. Long-term, the persistence of DPRK tactics supports continued risk controls and monitoring, but until security outcomes improve, this is more likely to pressure valuations than to provide a catalyst for a sustained bull move.