In 2025, cryptocurrency theft has advanced from easy rug pulls and opportunistic scams into subtle, nation-state–sponsored operations that concentrate on main exchanges and demanding infrastructure. Over $2.17 billion was stolen within the first half of 2025, and that determine continues to rise month by month.
In September alone, 20 crypto-related assaults resulted in $127.06 million in reported losses, highlighting the rising menace. Beneath are three high-profile hackers who’ve been concerned in main crypto assaults.
Sponsored
1. Lazarus Group
The Lazarus Group is an notorious, long-running hacking group backed by North Korea. Recognized by aliases resembling APT 38, Labyrinth Chollima, and HIDDEN COBRA, the group has constantly demonstrated the flexibility to bypass even probably the most superior safety methods.
Furthermore, Hacken famous that their operations date again to a minimum of 2007, starting with intrusions into South Korean authorities methods. Different notable assaults embrace the Sony Footage hack in 2014 (retaliation for the movie The Interview), the WannaCry ransomware outbreak in 2017, and ongoing campaigns concentrating on financial sectors in South Korea.
Lately, Lazarus has centered closely on cryptocurrency theft, stealing greater than $5 billion between 2021 and 2025. Essentially the most vital was the Bybit hack in February 2025, when the group stole $1.5 billion in Ethereum (ETH)—the most important crypto heist on file. Further operations included a $3.2 million Solana (SOL) theft in Might 2025.
“The DPRK’s ByBit hack basically altered the 2025 menace panorama. At $1.5 billion, this single incident not solely represents the most important crypto theft in historical past, but in addition accounts for about 69% of all funds stolen from providers this 12 months,” Chainalysis wrote in July.
Sponsored
2. Gonjeshke Darinde
Gonjeshke Darande (predatory sparrow) is a politically motivated cyberattack group, broadly believed to have ties to Israel. Amid escalating Israel-Iran conflicts, the group exploited Nobitex, Iran’s largest crypto alternate, stealing about $90 million earlier than burning the funds.
Gonjeshke Darande additionally uncovered Nobitex’s supply code publicly, undermining the alternate’s proprietary methods and delivering a significant blow to its credibility with customers and companions.
“12 hours in the past, 8 burn addresses burned $90 million from the wallets of the regime’s favourite sanctions violation instrument, Nobitex. 12 hours from now The source-code of Nobitex will likely be open to the general public, and Nobitex’s walled backyard will likely be with out partitions. The place would you like your property to be?” they posted in June.
The group’s different assaults have additionally centered on Iranian infrastructure, banks, and extra.
Sponsored
- In July 2021, Gonjeshke Darande disrupted Iran’s railway methods, inflicting main delays and posting mocking messages on public boards.
- In October 2022, the group attacked three main metal vegetation, releasing footage of fires that triggered critical bodily and financial injury.
- In Might 2025, they breached Financial institution Sepah, Iran’s state-owned financial institution, leaking delicate knowledge and disrupting monetary operations.
3. UNC4899
UNC4899 is one other North Korean state-sponsored crypto hacking unit. In accordance with Google’s Cloud Risk Horizons Report, the group operates underneath the Reconnaissance Common Bureau (RGB), North Korea’s main intelligence company.
Sponsored
The report revealed that the group has been lively since a minimum of 2020. Moreover, UNC4899 has concentrated its efforts on the cryptocurrency and blockchain sectors. The group has demonstrated superior capabilities in executing provide chain compromises.
“A notable instance is their suspected exploitation of JumpCloud, which they leveraged to infiltrate a software program options entity and subsequently victimize downstream prospects throughout the cryptocurrency vertical, underscoring the cascading dangers posed by such superior adversaries,” the report reads.
Between 2024 and 2025, the crypto hacker carried out two main crypto heists. In a single case, they lured a sufferer on Telegram, deployed malware by Docker containers, bypassed MFA in Google Cloud, and stole thousands and thousands in cryptocurrency.
In one other, they approached a goal through LinkedIn, stole AWS session cookies to bypass safety controls, injected malicious JavaScript into cloud providers, and once more siphoned off thousands and thousands in digital property.
Thus, this 12 months, crypto theft has change into a instrument of geopolitical battle as a lot as monetary crime. The billions misplaced this 12 months—and the strategic motives behind many assaults—reveal that exchanges, infrastructure suppliers, and even governments should now deal with crypto safety as a matter of nationwide safety. With out coordinated protection, intelligence sharing, and stronger safeguards throughout the ecosystem, the losses will solely proceed to escalate.