North Korean hackers drive $2.1 B crypto theft as violent kidnappings hit investors

Blockchain security firm CertiK reports that North Korea‑linked hacking groups were responsible for about $2.06 billion in cryptocurrency losses in 2025, representing roughly 60 % of all theft‑related losses that year and bringing the regime’s total crypto takings since 2016 to $6.75 billion. The groups rely on social‑engineering attacks, infiltrate DeFi platforms, and launder stolen funds rapidly through decentralized exchanges and cross‑chain bridges – in one case 86 % of the proceeds disappeared within a month.

Physical “wrench attacks,” in which criminals kidnap, assault or otherwise coerce crypto holders to hand over wallets, have caused more than $100 million in losses during the first four months of 2026. CertiK identified 34 verified incidents, with France accounting for 82 % of them; French authorities noted 41 cases during Paris Blockchain Week.

The FBI’s San Francisco division has charged three men with a violent crypto‑robbery and kidnapping scheme that stole $6.5 million, using delivery‑person disguises, firearms, duct tape and zip ties to force victims to transfer digital assets. The case highlights a growing trend of organized crime targeting crypto investors.

A separate $292 million exploit of the Kelp DAO protocol exposed weaknesses in DeFi lending markets, prompting industry insiders to call for baseline security measures such as zero‑trust architectures, multi‑signature controls and stricter collateral frameworks before larger institutional capital can be safely deployed.