North Korean hackers laundered over $1 billion in stolen crypto via professional networks following the $1.5B Bybit breach in February 2025.
Security & Exploits ·
North Korean threat actors have escalated their use of professional money-laundering intermediaries to process stolen cryptocurrency, according to analysis of recent activity. These specialized networks take control of funds early in the laundering process, deduct fees, and handle the operational risk of converting digital assets into usable currency. The Bybit breach in February 2025, which resulted in $1.5 billion in stolen funds, illustrated this pattern in action.
Between February and June 2025 following the Bybit incident, zeroShadow estimated that over $1 billion in stolen cryptocurrency had been laundered through these networks, though not all of that sum was necessarily converted to fiat currency. Elliptic traced roughly $200 million through the eXch platform and documented movement across multiple transfer routes, including cross-chain swaps, USDT conversions, and suspected connections to Chinese over-the-counter trading services.
The traceability of blockchain transactions has not translated into asset recovery; instead, returning stolen funds depends on active involvement from crypto exchanges, blockchain token issuers, and law enforcement agencies. Whether the full scope of laundered funds has been identified remains unclear, and the capacity of regulatory authorities to intervene at scale against organized laundering infrastructure has not been demonstrated.