Bybit Ethereum Heist Propels Record $2.1 Billion in Crypto Stolen by Hackers So Far in 2025

Hackers have stolen $2.1 billion in crypto, a record high in the first half of 2025, with North Korean-sponsored actors accounting for 70% of the losses, a report released Friday by blockchain intelligence provider TRM Labs shows. 

The total amount was 10% more than the previous high set in 2022, according to “H1 2025 Crypto Hacks and Exploits: A New Record Amid Evolving Threats,” which noted that North Korean groups were allegedly behind $1.6 billion of the stolen crypto. 

TRM said that North Korea has cemented its “position as the most prolific nation-state threat actor in the crypto space.” 

“Thefts serve as a critical tool of statecraft” for the country, the report added. 

The huge sum of swiped funds in the first half of this year was driven by the nearly $1.5 billion February theft of Ethereum and Ethereum-related assets from crypto exchange Bybit—the largest hack in the crypto industry’s history. 

Multi-signature wallet provider Safe said the heist stemmed from a compromised developer laptop. An investigation found that a high-level Safe developer’s workstation was compromised on February 4 when it interacted with a malicious docker project, or lightweight application.

Authorities accused North Korean hackers for the exploit of the Dubai-based exchange—and TRM Labs reached the same conclusion. 

“The February 2025 Bybit breach… reshaped the narrative for the year, inflating average hack size and underscoring the strategic use of cybercrime by nation-states,” the report noted. 

U.S. authorities have long alleged that North Korea’s heavily sanctioned government uses hackers to steal crypto and fund its nuclear program. 

Major crypto hacks have often been traced back to the country, which is run by dictator Kim Jong Un. 

TRM Labs said that crypto hacks increasingly appear “symbolic or strategic rather than financially motivated, highlighting a shift in how crypto crime is weaponized.”

The report further added that 80% of losses this year were due to infrastructure attacks, where hackers get control of private keys and seed phrases. 

Edited by James Rubin