North Korean state-backed hackers reached unprecedented levels of cryptocurrency theft in 2024, stealing $1.6 billion through various cyber attacks, according to a new report by blockchain analytics firm Chainalysis. This amount represents a dramatic increase from the $660.5 million stolen in 2023.
The regime's cyber operatives conducted 47 separate attacks throughout the year, doubling their activity compared to 2023. Their efforts accounted for 61% of all cryptocurrency stolen globally in 2024, which totaled $2.2 billion.
Security experts believe the stolen funds directly support North Korea's weapons development and ballistic missile programs. U.S. officials estimate that up to one-third of the country's missile program funding comes from illicit cyber activities.
The hackers have refined their methods, deploying sophisticated malware and infiltrating cryptocurrency firms by posing as remote workers. In one major case, U.S. authorities indicted 14 North Korean nationals who used false identities to secure remote IT positions, ultimately generating $88 million through data theft and extortion.
The scale of individual attacks also increased in 2024, with more heists exceeding $100 million than in previous years. Smaller attacks under $50 million became more frequent as well.
Notably, most of the theft occurred during the first half of 2024, with activity declining sharply after June. This slowdown coincided with strengthened ties between North Korea and Russia following a meeting between Kim Jong Un and Vladimir Putin. Analysts suggest this timing may indicate a shift in cyber resources toward supporting Russia's military operations in Ukraine.
Despite the second-half slowdown, North Korea's hackers dominated the cryptocurrency crime landscape in 2024, conducting two-thirds of all global hacking incidents and setting new records for stolen assets.