While these figures are global, their implications are increasingly focused on Africa, as crypto adoption grows rapidly across the continent, driven by remittances, currency instability and financial exclusion.
On-Chain Analysis estimates that North Korea accounted for between 59% and 76% of all major cryptocurrency thefts during the year, stealing at least $2.02 billion in 2025 alone.
This brought the cumulative amount of crypto crime in the country to approximately $6.75 billion, making it the most significant threat to the digital asset ecosystem.
According to Andrew Fierman, Head of National Security Intelligence at Chainalysis. “North Korea’s sophistication and effectiveness in laundering the proceeds of these incidents continues to improve,” he added.
The report comes at a time when investing in crypto has become mainstream. More and more people own cryptocurrencies, and because transactions are irreversible, individuals and exchanges increasingly become targets.
“If you are talking online about your success in crypto investments, I recommend that you do not do that,” Fierman added. “This indicates that you potentially have a hardware wallet and creates a physical target for you as an individual.”
North Korea emerges as dominant crypto threat actor
Unlike traditional cybercriminal groups, North Korean hackers operate with strategic patience, executing fewer attacks but extracting far greater sums of money.
In 2025, their operations accounted for a record share of service level violations, highlighting the growing role of state actors in cryptocrime.
The country’s record performance in 2025, achieved with 74% fewer known attacks, suggests that we may only be seeing the most visible part of its activities.
The Bybit hack and the rise of large-scale breaches
The scale of the threat was illustrated in February, when Dubai-based exchange Bybit suffered a $1.4 billion to $1.5 billion breach, the largest crypto hack on record.
This single incident accounted for approximately 40% of all cryptocurrencies stolen globally in 2025. Chainalysis found that just three major hacks accounted for more than two-thirds of all cryptocurrencies stolen, highlighting a shift toward fewer but far more devastating breaches.
Personal wallet attacks increase as retail users bear the risk
Beyond high-profile exchange hacks, the report highlights a sharp increase in personal wallet compromises, particularly relevant to Africa.
Personal wallet compromises have also increased significantly, from 7.3% of total value stolen in 2022 to 44% in 2024, and would have been 37% in 2025 without the outsized impact of the Bybit attack.
Chainalysis recorded 158,000 attacks on individual wallets in 2025, almost triple the number seen in 2022.
These attacks rely heavily on social engineering, including phishing emails, fake investment messages, and impersonation scams.
For African users, many of whom self-custody their assets through mobile wallets and peer-to-peer platforms, such attacks present a growing vulnerability.
Why Africa is increasingly exposed
Africa is one of the fastest growing crypto markets in the world, with Nigeria, Kenya, South Africa and Ghana among the most active peer-to-peer trading hubs. Crypto is widely used for cross-border payments, self-employment, and inflation hedging.
However, regulatory oversight, consumer protection and cybersecurity awareness remain patchy, making the continent a potential target for sophisticated cybercriminals.
Inside Tactics: Infiltration, Impersonation, and Deception
North Korean hackers have refined their methods by integrating fake IT professionals into crypto exchanges, custodians and Web3 companies.
Using stolen identities and AI-assisted tools, they secure remote roles, gain privileged access, and discreetly enable large-scale theft.
More recently, they have posed as recruiters and investors, staging fake hiring processes or partnership negotiations to harvest credentials and gain access to internal systems, a development that continues earlier infiltration tactics.
A growing test for Africa’s crypto future
For African regulators, platforms and users, the warning is clear. As crypto fills the gaps left by traditional finance, security and education must advance at the same pace.
Without stronger safeguards, the same technologies that are expanding financial access across the continent risk becoming new entry points for global cybercrime networks operating, as Chainalysis notes, under “very different rules than typical criminals.”
The challenge for 2026 will be to detect and prevent high-impact operations before DPRK-affiliated actors cause another Bybit-scale incident.
