North Korean hackers net $1.6 billion in crypto in 2025, leveraging AI and freelance scams

North Korean Hackers Unleash Crypto Havoc in 2025

The year 2025 has witnessed an alarming escalation in cyber threats originating from North Korea, with sophisticated hacker groups raking in an estimated $1.6 billion in stolen cryptocurrency. These digital brigands are employing increasingly cunning tactics, leveraging the allure of freelance work in the IT and crypto sectors to infiltrate secure cloud systems and siphon vast digital fortunes. It's a stark reminder that in the fast-paced world of decentralized finance, vigilance is not just a virtue, it's a necessity.

The Art of the Deception: Freelancer Scams as Entry Points

Google Cloud's Threat Intelligence Group has identified a persistent and evolving threat actor, UNC 4899, also known by aliases such as TraderTraitor, Jade Sleet, or Slow Pisces. This North Korean cyber unit has demonstrated a chilling effectiveness, successfully breaching two companies by luring employees through social media interactions. The modus operandi is insidious: victims are offered seemingly legitimate freelance tasks, which, upon acceptance, trigger the execution of malware on their workstations. This malicious payload acts as a digital backdoor, establishing a critical link between the attackers' command-and-control infrastructure and the target organization's cloud environment.

Unmasking the Digital Raiders: UNC 4899 and Its Kin

UNC 4899 is believed to be closely affiliated with notorious state-sponsored cyber operations, including the Lazarus Group and Kimsuky Group, known for their relentless pursuit of financial gain and strategic disruption. Once inside the cloud environment, these digital predators meticulously explore the victim's systems, relentlessly hunting for credentials. Their ultimate goal? To pinpoint and compromise hosts responsible for managing cryptocurrency transactions. While the individual incidents targeted different companies and cloud platforms, including stalwarts like Google Cloud and AWS, the outcome was tragically consistent: multi-million dollar cryptocurrency heists.

AI: The Hacker's New Secret Weapon

What makes these recent attacks particularly concerning is the adeptness with which North Korean actors have embraced cutting-edge technologies. Artificial intelligence (AI) is no longer just a buzzword; it's a potent tool in the arsenal of these cybercriminals. They are employing AI to craft more convincing phishing emails, making them harder to distinguish from legitimate communications. Furthermore, AI is being utilized to write more sophisticated and evasive malicious scripts, amplifying their ability to bypass security measures. It’s a chilling example of how innovation can be weaponized, turning the tools of progress into instruments of crime.

Record-Breaking Heists and a Dominant Market Share

The sheer scale of these operations is staggering. The TraderTraitor group, in particular, has been implicated in some of the most significant cryptocurrency heists ever recorded. Notable among these were the $305 million breach of Japan's DMM Bitcoin and a colossal $1.5 billion exploit targeting the Bybit crypto exchange. These incidents, combined with numerous smaller raids, have propelled North Korea to the forefront of cryptocurrency theft globally. Astonishingly, the nation was responsible for a staggering 35% of all stolen cryptocurrency funds in the past year, solidifying its position as a dominant force in this illicit market. This trend, as highlighted in the Cloud Threat Horizons Report H2 2025, paints a grim picture of the ongoing battle for digital security in the cryptocurrency landscape.