North Korean State-Sponsored Cyberattacks: Billions Stolen from Crypto via Cloud & Social Engineering

The global cryptocurrency landscape is grappling with a persistent and escalating threat from state-sponsored cybercriminal organizations, with North Korean hacking groups emerging as particularly formidable adversaries. These sophisticated entities are estimated to have successfully exfiltrated a staggering $1.6 billion in digital assets during 2025, signaling a marked intensification of their illicit financial campaigns against the burgeoning blockchain ecosystem.

• North Korean hacking groups are estimated to have stolen $1.6 billion in digital assets during 2025.
• These groups, including TraderTraitor and UNC4899, primarily employ elaborate social engineering tactics, often using fake job offers.
• Their methodologies have evolved, with a significant pivot in 2024-2025 towards large-scale social engineering campaigns targeting cryptocurrency exchanges.
• Major incidents include a $303 million breach of DMM Bitcoin and a $1.5 billion exploit targeting the Bybit exchange in February 2025.
• The hacker network associated with TraderTraitor is believed to number in the thousands, with attacks expected to scale further.
• The wider cryptocurrency sector incurred over $2.1 billion in total losses during the first half of 2025 alone.

Operating under various designations such as UNC4899, TraderTraitor, Jade Sleet, and Slow Pisces, these groups have refined their methodologies to compromise targeted organizations. A predominant tactic involves intricate social engineering schemes, frequently disguised as legitimate recruitment efforts. By leveraging fraudulent job offers and engaging in prolonged, trust-building communication—even deploying artificial intelligence to enhance the authenticity of their interactions—they manipulate individuals into executing malicious software. This grants the attackers remote access to enterprise cloud environments, facilitating the theft of critical credentials and pinpointing systems involved in cryptocurrency transactions.

Strategic Targeting of Cloud Infrastructure

Analysis conducted by Google Cloud and cybersecurity firm Wiz indicates that these operations span across multiple cloud service providers, including Google Cloud and Amazon Web Services (AWS). This strategic focus on cloud infrastructure is critical, as it forms the backbone for numerous modern financial and cryptocurrency operations. Benjamin Read, Director of Threat Intelligence at Wiz, underscored this vulnerability, stating, “TraderTraitor focuses on cloud attacks because that’s where the data — and therefore the money — is stored. This is especially true for the crypto industry, which often builds its infrastructure with a ‘cloud-first’ approach.”

The evolution of these sophisticated tactics has been meticulously tracked over several years. Initially, between 2020 and 2022, attacks frequently involved malicious cryptocurrency applications built on JavaScript. By 2023, a discernible shift occurred towards injecting malicious open-source code into projects. However, the period of 2024-2025 has witnessed a significant pivot towards large-scale social engineering campaigns, particularly targeting cryptocurrency exchanges through deceptive IT job vacancies.

Significant Financial Impact

The financial repercussions of these sophisticated campaigns are substantial and far-reaching. Notable incidents directly attributed to these groups include the breach of Japanese exchange DMM Bitcoin, which resulted in a loss of approximately $303 million, and a significant exploit targeting the Bybit exchange, where an estimated $1.5 billion was reportedly compromised in February 2025. These figures unequivocally underscore the capacity of these state-backed operations to inflict considerable financial damage on the industry.

The scale of this persistent threat is also expanding. Current estimations suggest that the network of hackers associated with TraderTraitor could number in the thousands, operating across interconnected or parallel cells. Jamie Collier, Principal Advisor for Threat Intelligence at Google Threat Intelligence Group, cautioned against complacency, asserting, “We see no signs of their attacks slowing down and expect further scaling.” This assessment aligns with broader industry observations, as TRM Labs previously reported that the cryptocurrency sector incurred total losses exceeding $2.1 billion during the first half of 2025 alone, indicating a pervasive and growing threat landscape.