{"id":158188,"date":"2026-04-29T08:36:22","date_gmt":"2026-04-29T08:36:22","guid":{"rendered":"https:\/\/mycryptomania.com\/?p=158188"},"modified":"2026-04-29T08:36:22","modified_gmt":"2026-04-29T08:36:22","slug":"north-korea-stole-7-5-billion-from-crypto-so-far-heres-their-playbook","status":"publish","type":"post","link":"https:\/\/mycryptomania.com\/?p=158188","title":{"rendered":"North Korea Stole $7.5 Billion From Crypto So Far. Here\u2019s Their Playbook."},"content":{"rendered":"

At 2:16 AM in Dubai, a Bybit signer approved what looked like a routine transfer. It wasn\u2019t. Somewhere near Pyongyang, a room full of operatives erupted in celebration. They had just pulled off the largest financial theft in history $1.5 billion, gone in a single block confirmation.<\/strong><\/p>\n

This wasn\u2019t an anomaly. It was the climax of a decade-long playbook.<\/p>\n

The Numbers Are Staggering<\/strong><\/p>\n

North Korea\u2019s Lazarus Group has stolen over $7.5 billion in crypto<\/strong> since 2017. By 2025, they were responsible for 59% of all crypto theft on the planet<\/strong>. The UN estimates this represents roughly 13% of North Korea\u2019s entire GDP<\/strong> directly funding ballistic missiles and nuclear research.<\/p>\n

In April 2026 alone, they struck twice in 17 days for a combined $575\u00a0million<\/strong>.<\/p>\n

It Started With a LinkedIn\u00a0Message<\/strong><\/p>\n

Lazarus rarely begins with a smart contract bug. They begin with a\u00a0human.<\/p>\n

Fake recruiters with AI-generated profiles. Staged video calls using voice cloning. One target went through six interview rounds before malware arrived on round seven. The bait: a job offer, a collaboration, a PDF. That\u2019s how the Ronin Network lost $625 million<\/strong> a senior Sky Mavis engineer opened an \u201coffer\u00a0letter.\u201d<\/p>\n

By 2025, they evolved further posing as venture capital firms<\/strong>, attending conferences, running fake pitch meetings specifically designed to extract: \u201cHow is your treasury custodied?\u201d<\/em><\/p>\n

They\u2019re Already Inside Your\u00a0Team<\/strong><\/p>\n

Beyond phishing, North Korea has been placing operatives under fabricated Western identities directly inside crypto companies<\/strong>. Researchers call this Wagemole<\/strong>. Estimates suggest over 40 DeFi protocols<\/strong> have unknowingly employed DPRK operatives since\u00a02020.<\/p>\n

These aren\u2019t smash-and-grab attackers. They ship real code, attend standups, earn promotions and wait for the command from Pyongyang.<\/p>\n

The Bybit Hack Rewrote the\u00a0Rules<\/strong><\/p>\n

Bybit used industry-standard multi-sig. Trained signers. Documented processes. None of it mattered.<\/p>\n

Lazarus social-engineered a Safe developer, gained backend access, and deployed a targeted UI change<\/strong> visible only when Bybit\u2019s specific wallet addresses were in view. Signers saw a routine transfer. What they actually signed: a delegatecall handing Lazarus full control. The malicious code self-deleted within two minutes. 401,347 ETH was\u00a0gone.<\/strong><\/p>\n

No smart contract exploit. No key theft. Just a lying frontend.<\/p>\n

The Newest Threat: Infrastructure Poisoning<\/strong><\/p>\n

Seventeen days after Bybit, they struck KelpDAO for $290 million<\/strong> using a technique the industry had never seen at scale: RPC node poisoning + DDoS-forced failover<\/strong>. The protocol was never exploited. The smart contracts were never touched. The lie lived entirely in the off-chain verification layer.<\/p>\n

Every bridge, oracle, and cross-chain protocol relying on RPC infrastructure to verify on-chain state now operates in a world where that infrastructure can silently lie and erase all evidence.<\/p>\n

The mismatch is the vulnerability.<\/strong> Crypto has spent hundreds of millions auditing contracts. Lazarus attacks the humans and the\u00a0tooling.<\/p>\n

Wanna know more? We have a detailed blog on <\/em>North Korea\u2019s Complete Crypto Hacking Playbook<\/em><\/strong> covering every major attack, the full 5-phase methodology, red flags to watch for, and a complete defense checklist.<\/em><\/p>\n

Read the full breakdown \u2192<\/strong><\/a><\/p>\n

North Korea Stole $7.5 Billion From Crypto So Far. Here\u2019s Their Playbook.<\/a> was originally published in Coinmonks<\/a> on Medium, where people are continuing the conversation by highlighting and responding to this story.<\/p>","protected":false},"excerpt":{"rendered":"

At 2:16 AM in Dubai, a Bybit signer approved what looked like a routine transfer. It wasn\u2019t. Somewhere near Pyongyang, a room full of operatives erupted in celebration. They had just pulled off the largest financial theft in history $1.5 billion, gone in a single block confirmation. This wasn\u2019t an anomaly. It was the climax […]<\/p>\n","protected":false},"author":0,"featured_media":158189,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-158188","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-interesting"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/158188"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=158188"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/158188\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/media\/158189"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=158188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=158188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=158188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}