DPRK (North Korea) Cyber Risk
Last updated 17 October 2026Last verified 17 October 2026
What is DPRK (North Korea) cyber risk in DeFi?
State-sponsored hacking groups (Lazarus, TraderTraitor) attributed to North Korea have stolen at least $6.75Bn in crypto in total (Chainalysis lower-bound estimate, December 2025), including a record $2.02Bn in 2025, primarily via social engineering of employees and contractors rather than direct protocol exploits. The approximately $1.5Bn Bybit theft (2025) is the largest single incident on record. A geopolitical risk category that most traditional risk frameworks do not adequately capture.
TradFi equivalentThe bank-side counterpart is the 2016 Bangladesh Bank heist, the same group moving $81MM on compromised SWIFT credentials. The entry point is a person or a workstation rather than the protocol, and because the counterparty is a sanctioned state, any negotiation over the stolen funds is itself a sanctions question.