According to Chainalysis, North Korea-affiliated cybercriminals have already stolen over $2.17 billion in cryptocurrency within the first half of the year. This staggering sum surpasses the total theft recorded in 2024, positioning 2025 as the worst year to date for crypto-related losses.

Massive Cryptocurrency Heists

Among the most significant incidents was the February 21 breach of Bybit, resulting in the loss of nearly $1.5 billion in Ethereum. This event stands as the largest single crypto theft in history. Following this, a series of attacks, including a $37 million hack of South Korean exchange Upbit, have been attributed to North Korean actors.

The regime’s relentless cyberattacks persist despite escalating international efforts to impose sanctions on the country and its associated entities. Andrew Fierman, head of national security intelligence at Chainalysis, stressed that North Korea’s tactics are ever-evolving and deeply embedded across various jurisdictions.

Evolving Tactics of North Korean Crypto Hacks

The DPRK has refined its hacking techniques, adopting aggressive strategies such as coordinated supply-chain attacks targeting service providers and fund custodians. Their infiltration extends into IT firms within AI, blockchain, and defense sectors under false identities, aiming to access cryptocurrency reserves.

The laundering of stolen crypto has also become increasingly sophisticated. Chainalysis notes that these funds are channeled through diverse paths, including mixing services, OTC brokers, chain-hopping, token swaps, decentralized exchanges, and bridge protocols to obscure their flow.

Future Threats and Preventive Measures

The integration of AI technologies could further enhance North Korea’s hacking capabilities, aiding in crafting convincing personas and automating the laundering process. To combat these threats, enhanced due diligence by companies is crucial. Implementing stricter identity-verification checks, IP monitoring, and limits on opaque payment methods can help detect potential threats.

Fierman emphasized the importance of collaboration between platforms, private sectors, and law enforcement to effectively counteract these cyber threats. Quick intelligence sharing and clear response pathways are vital to limiting the opportunities for illicit activities and acting as deterrents for future attacks.

While the battle against North Korean crypto hacks is ongoing, these preventive strategies could play a pivotal role in safeguarding the global cryptocurrency ecosystem.

Disclaimer: The Block remains an independent media outlet committed to delivering accurate and timely information about the crypto industry.

The post North Korean Crypto Hacks: 5 Shocking Insights into Massive Theft Escalation appeared first on Crypto Market Insights: Dive In with CryptoUpdate.io.

Chainalysis disclosed to WIRED on June 5 that the 300 Bitcoin (BTCUSD) donation to Ulbricht is believed to have originated from Alphabay. This market operated from 2014 to 2017, serving as a precursor to the Silk Road.

Director of investigations at Chainalysis, Phil Larratt, stated, “We have reasonable grounds to suspect that these funds originated in AlphaBay”. He speculated that the donation likely came from a major vendor on the platform with access to such significant amounts.

Further corroborating this claim, independent blockchain investigator ZachXBT confirmed that the 300 Bitcoin did not originate from Silk Road, and there were noticeable patterns in how the donor moved the funds. ZachXBT pointed out the use of multiple mixing services to blur the transaction trail and the cashing out of other cryptocurrencies in small increments to avoid detection. These factors suggest a possible criminal origin.

ZachXBT noted the donation seemingly came from a “dodgy centralized mixing service”, Jambler, while ordinary privacy enthusiasts typically use decentralized mixers, such as Wasabi and the now-defunct Samourai.

ZachXBT suggested to WIRED that although the money appears to be a “legitimate donation,” the funds themselves do not seem to be legitimate. The use of multiple mixers and CEX (centralized exchange) deposits spread out is a typical strategy for avoiding seizure of illicit funds.

Chainalysis was pivotal in identifying Bitcoin addresses linked to AlphaBay, significantly contributing to the 2016-2017 “Operation Bayonet” investigation, which led to the darknet marketplace’s takedown. If the Bitcoins donated to Ulbricht had been held since then, they could have appreciated over 40 times their original value. The identity and motivations of the donor, however, remain undisclosed.

In January, US President Donald Trump pardoned Ross Ulbricht, who had been serving a double life sentence plus 40 years for his role in creating and operating Silk Road.

The post Silk Road Founder Receives $31 Million Bitcoin Donation from Alleged Alphabay Wallet: Investigation Reveals appeared first on Crypto Market Insights: Dive In with CryptoUpdate.io.

Chainalysis’ 2025 crypto crime report shed light on the ebbs and flows of the year. In the first half of 2024, it seemed like the cybercriminals were on track for another year of record earnings, with a 2.4% increase in the value stolen compared to 2023, including a massive $75 million ransom paid by an undisclosed victim to the Dark Angels group. However, the second half of 2024 witnessed a drastic reduction in ransomware payments, causing the total value extorted for the year to decrease.

Centralized exchanges were still the preferred channel for the criminals to convert their ill-gotten crypto into fiat. However, sanctions against Cryptex, a Russian-based exchange, and the seizure of 47 non-KYC Russian language crypto exchanges by the German Federal Criminal Police in the previous year, hampered the criminals’ ability to launder their illegal proceeds, according to Chainalysis.

“There’s an increasing reluctance among ransomware operators, majorly driven by financial motives, to cash out. This could be indicative of their fear of getting traced, identified, and prosecuted by law enforcement agencies, thanks to crypto investigation tools,” stated Jacqueline Burns Koven, Chainalysis Head of Cyber Threat Intelligence.

Chainalysis also highlighted a growing disparity between the ransoms demanded by attackers and the amounts actually transferred by victims on the blockchain. Despite a rise in the number of ransomware incidents, the payout gap swelled to 53% in the latter half of 2024, suggesting that more victims were standing their ground and refusing to pay the ransom, Chainalysis reported. The typical payment from victims who did give in to the hackers’ demands ranged between $150,000 and $250,000, regardless of the original ransom amount.

“The cybersecurity landscape seemed to be spiralling towards a ransomware apocalypse. This considerable drop, even lower than the figures of 2020 and 2021, is a testimony to the effectiveness of law enforcement actions, enhanced international cooperation, and the escalating refusal of victims to succumb to the attackers’ demands,” Koven commented.

Disclaimer: The Block is an independent news platform focused on delivering the latest news, research, and data in the crypto sector. As of November 2023, Foresight Ventures is its primary investor. Foresight Ventures also invests in other crypto entities. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block remains committed to providing objective, impactful, and timely information about the crypto industry. This article is for informational purposes only and should not be used as financial, legal, tax, investment, or other advice.

The post Crypto Ransomware Extortion Falls by 35% in 2024 as Exchanges Clamp Down and Victims Fight Back: Chainalysis appeared first on Crypto Market Insights: Dive In with CryptoUpdate.io.

Citing Tether’s official Twitter account, the source says that the company has no intention to pay the ransom demand. They explain the decision by suggesting that hackers did not make their intentions clear, so the demand might be simply a part of an extortion scheme, and the documents are likely fake.

Cryptocurrency prices continue to fluctuate, and Bitcoin is making its way to new highs. As a result, hacking and ransomware attacks, in particular, are increasing. According to Chainalysis, hackers made at least $350 on ransomware attacks in 2020. Moreover, the firm found that this amount is 311% more than what victims of attacks paid in 2019.

Tether has been a victim of hacking before. In 2017, the firm had USDT worth $30 million stolen. Hackers moved the funds from the company wallet to an unauthorized Bitcoin address. At the time, the company made attempts to prevent the movement of stolen tokens into the broader ecosystem. Tether is a stablecoin pegged to the US dollar, with the value of each coin being $1.

The post Tether does not plan to go along with a ransom demand of $23 million appeared first on Crypto Market Insights: Dive In with CryptoUpdate.io.