North Korean crypto attacks rising in sophistication, actors — Paradigm

North Korean cyberwarfare attacks on the cryptocurrency industry are growing in sophistication and in the number of groups involved in such criminal activity, crypto firm Paradigm warns in report titled “Demystifying the North Korean Threat.”

North Korea-originated cyberattacks range from assaults on exchanges and social engineering attempts to phishing attacks and complex supply chain hijacks, the report says. In some cases, the attacks take a year to play out, with North Korean operatives biding their time.

The United Nations estimates that between 2017 and 2023, North Korean hackers have netted the country $3 billion. The total haul has skyrocketed in 2024 and this year, with successful attacks against crypto exchanges WazirX and Bybit, which together netted attackers around $1.7 billion.

Paradigm writes that the North Korean organizations orchestrating these attacks number at least five: Lazarus Group, Spinout, AppleJeus, Dangerous Password, and TraitorTrader. There is also a coalition of North Korean operatives who pose as IT workers, infiltrating tech companies around the world.

Related: Typosquatting in crypto, explained: How hackers exploit small mistakes

High-profile attacks and predictable laundering methods

Lazarus Group, the most well-known North Korean hacking team, is given credit for some of the most high-profile cyberattacks since 2016. According to Paradigm, the group hacked Sony and the Bank of Bangladesh in 2016 and helped orchestrate the WannaCry 2.0 ransomware attack in 2017.

It has also taken aim at the cryptocurrency industry, sometimes to great effect. In 2017, the group hit two crypto exchanges — Youbit and Bithumb. In 2022, Lazarus Group exploited the Ronin Bridge, resulting in hundreds of millions in lost assets. And in 2025, it infamously stole $1.5 billion from Bybit, sending shock throughout the crypto community. The group may be behind some Solana memecoin scams.