537/68 Monday, December 22, 2025
A recent report from Chainalysis, a leading blockchain analytics firm, reveals alarming figures for 2025, stating that North Korean hackers have stolen at least USD 2 billion in cryptocurrency, marking a significant increase from 2024. A major contributor was the attack on the Bybit platform, which alone resulted in losses of approximately USD 1.5 billion, making 2025 the most financially damaging year on record. While the overall frequency of attacks has declined, threat actors have shifted toward high-value targets and are spending more time laundering stolen funds.
Beyond direct cyberattacks, the threat has expanded into social engineering through fake IT workers. According to Amazon, since April 2024 the company has detected and blocked more than 1,800 North Korean applicants attempting to apply for high-paying technical and AI-related positions using false identities. These operations involve sophisticated tactics, including stealing real software engineers’ résumés, hiring individuals in the United States to host laptops in order to spoof geolocation, and embedding themselves as insiders within cryptocurrency and Web3 companies to steal sensitive information and digital assets.
To counter these increasingly subtle threats, Amazon security leadership advises organizations to watch for small but telling red flags, such as unnatural phone number formatting or educational histories that do not align with legitimate university programs. Investigations also show that threat actors have adapted their approach by impersonating recruiters or investors to lure victims into revealing sensitive information or credentials. These developments underscore a growing risk that businesses must monitor closely as adversaries continue to refine their techniques.
