North Korea’s cryptocurrency thieves started 2025 with a heist for the history books, stealing $1.46 billion in one swoop to kick-start another year in service to the regime.

The record-breaking heist epitomized North Korea's evolving approach to virtual crime: months of patient reconnaissance, sophisticated social engineering tactics and rapid laundering through a complex web of sanctioned tools and Chinese underground networks.

In the months that followed, North Korean actors — from elite cybercrime actors like the Lazarus Group to fraudulent IT workers — fanned out across the crypto ecosystem, exploiting exchanges, blockchain firms and trusted insiders.