What was once a fringe concern about nation-state involvement in crypto theft is now confirmed reality. North Korea’s Lazarus Group stole over $2 billion in 2025 alone, pushing the regime’s total crypto theft since 2017 past $6.75 billion. The United States, South Korea, and Japan have all officially confirmed Lazarus’s role in major attacks including Bybit.^[6]

What makes these actors so hard to stop is their patience. Lazarus operatives spend months building relationships, infiltrating vendor ecosystems, and staging attacks that exploit human trust rather than code vulnerabilities. The funds go directly to financing North Korea’s nuclear and ballistic missile programs, which means every Lazarus hack carries geopolitical consequences that extend well beyond the blockchain.

The Bybit hack did not begin at Bybit. It started at Safe, a respected wallet infrastructure provider, where attackers compromised a developer’s machine. When that developer’s code was later deployed into Bybit’s production environment, the attackers already had everything they needed to authorize a $1.46 billion transfer. The exchange itself was never directly breached.

This is the defining shift of 2025. The security perimeter is no longer the exchange itself. It is every vendor, contractor, and third-party developer the exchange relies on. Social engineering attacks targeting individual developers, customer support staff, and subcontractors became the dominant entry vector this year. Human trust is being exploited at scale, and no amount of code auditing catches it.

The private key is the single point of control over any crypto wallet. Lose it and you lose everything, with no recourse. In H1 2025, private key theft accounted for 69% of all stolen value, a figure that reflects both the scale of nation-state operations and a relentless epidemic of malware and phishing targeting everyday users. With 158,000 documented cases affecting over 80,000 unique victims, this is the form of crypto crime most users are most likely to personally encounter.^[2]

Attack methods include information-stealing malware hidden in fake job offers (a Lazarus specialty), seed phrase phishing via lookalike websites, and clipboard hijacking tools that silently swap wallet addresses during transfers.

Centralized exchanges are crypto’s banks. They concentrate enormous pools of value inside infrastructure that, if breached, produces catastrophic and largely unrecoverable losses. In Q1 2025, private key breaches accounted for 88% of all stolen amounts, with the vast majority coming from CEX hot wallets. Hot wallets are internet-connected and designed to make withdrawals fast and seamless, which is exactly what users want and exactly what attackers exploit. In 2025, that convenience tradeoff cost the industry billions.^[3]

The same instant liquidity that makes centralized exchanges appealing to everyday traders is what makes them the highest-value targets for nation-state hackers and organized criminal groups.

Generative AI handed attackers a powerful new toolkit in 2025. Deepfake videos of Vitalik Buterin, Elon Musk, and Binance founder CZ were deployed across social media to promote fraudulent investment schemes. The quality of these fakes improved dramatically over the year, making visual verification increasingly unreliable.

On top of that, AI-written phishing emails have become nearly impossible to distinguish from legitimate exchange communications. Perfect grammar, correct branding, and the right level of urgency. The Nigerian prince era of obvious scams is long gone. Today’s AI-generated phishing regularly fools security-aware professionals who know what to look for.

Cross-chain bridges are some of the most technically complex infrastructure in the entire crypto ecosystem, and also among the most frequently exploited. Because bridges have to coordinate logic across multiple blockchains at the same time, they create interaction surfaces that even the most thorough security audits can miss. In 2025, they remained high-value targets for exactly this reason. A single successful exploit can drain assets locked across multiple chains simultaneously, making the potential payoff enormous relative to the effort required.

Flash loan attacks exploit one of DeFi’s most unusual features: the ability to borrow enormous amounts of capital within a single transaction block, with no collateral required, as long as everything is repaid before the block closes. Attackers use this to temporarily manipulate price oracles and execute trades that would otherwise be impossible. The entire operation unfolds and resolves in one atomic transaction. The Abracadabra flash loan exploit in October 2025 extracted $1.8 million by finding a rounding error buried in smart contract logic. Small bugs, it turns out, can carry very large price tags.

The Coinbase breach of May 2025 required no sophisticated hacking at all. Attackers bribed overseas customer support subcontractors to hand over user data. That is it. No zero-day vulnerabilities, no advanced persistent threat tooling, just cash changing hands. The estimated cost of remediation and user compensation hit $400 million.^[8]

Meanwhile, Figure Technology was compromised through a single social engineering attack targeting one employee, with the ShinyHunters group walking away with 2.5GB of customer data. The pattern is consistent across both cases. The crypto industry has invested heavily in smart contract security while leaving its human layer almost entirely undefended.

Stealing the funds is only half the problem. Converting billions in stolen crypto into usable currency without being traced is a complex operational challenge, and North Korea has solved it methodically. The regime runs a structured 45-day laundering pipeline: stolen ETH first moves through decentralized exchanges to break the tracing chain, then gets routed across bridges to different networks, sent through mixing services operating as Tornado Cash alternatives, funneled into Chinese-language OTC broker networks, and finally converted to fiat through peer-to-peer platforms. The permissionless, no-KYC nature of DeFi makes it nearly purpose-built for this kind of operation.

Not everything in 2025 went the attackers’ way. The Venus Protocol incident is the year’s clearest evidence that proactive security actually works. When Hexagate’s AI monitoring system picked up unusual patterns 18 hours before a planned attack on BNB Chain, the protocol had time to act. When the attacker finally executed, the exploit failed completely and they lost money in the process.^[9]

Across the industry, on-chain governance mechanisms that let token holders vote to freeze compromised assets are beginning to emerge as a legitimate defensive layer. If widely adopted, they could meaningfully change the risk calculation for attackers targeting DeFi protocols.