North Korea has quietly built the most profitable state-sponsored cybercrime operation in history, and DeFi's permissionless infrastructure is its preferred getaway vehicle. According to Chainalysis, North Korean hackers stole $2.02 billion in cryptocurrency in 2025 alone — a 51% increase over 20...
"Node operators on Thorchain are not unlike node operators on other chains. They are not there to form an opinion on who should use the chain." — John-Paul Thorbjornsen, THORChain Original Developer
North Korea has quietly built the most profitable state-sponsored cybercrime operation in history, and DeFi's permissionless infrastructure is its preferred getaway vehicle. According to Chainalysis, North Korean hackers stole $2.02 billion in cryptocurrency in 2025 alone — a 51% increase over 2024 — bringing cumulative DPRK crypto theft to an estimated $6.75 billion. The single largest heist, the $1.5 billion Bybit exchange compromise of February 2025, demonstrated a new level of operational sophistication: the Lazarus Group laundered the entire haul in just 10 days, routing approximately $900 million of it through THORChain, a decentralized cross-chain swap protocol that collected $5.5 million in transaction fees from the process.
This report examines the collision between state-sponsored crypto theft and DeFi's permissionless architecture. THORChain's crisis — simultaneously grappling with $200 million in toxic debt, a RUNE token trading at $0.41, and the reputational fallout of enabling the largest laundering operation in crypto history — is a microcosm of a systemic problem. The Tornado Cash ruling of 2024 established that immutable smart contracts cannot be sanctioned as "property," but left unanswered whether node operators, liquidity providers, and protocol governors who choose to keep illicit channels open bear criminal liability. As North Korea integrates AI into its attack pipeline and crypto crime losses reached $3.4 billion in 2025, the industry faces an existential question: can permissionless finance survive a nation-state adversary?
The numbers paint a stark picture. Between 2017 and 2025, North Korean-linked hacking groups have stolen over $6.75 billion in cryptocurrency, according to cumulative data from Chainalysis, TRM Labs, and the FBI's Internet Crime Complaint Center. What was once opportunistic raiding has industrialized into a sovereign wealth function denominated entirely in stolen digital assets.
Year-over-year escalation:
| Year | Estimated DPRK Crypto Theft | Notable Targets | |------|----------------------------|-----------------| | 2022 | ~$1.7 billion | Ronin Bridge ($620M), Harmony ($100M) | | 2023 | ~$1.0 billion | Atomic Wallet ($35M), CoinEx ($55M) | | 2024 | >$1.3 billion | Multiple exchange compromises | | 2025 | $2.02 billion | Bybit ($1.5B), Upbit ($30M) |
In 2025, DPRK attacks accounted for a record 76% of all service compromises globally. As Perry Choi of Aeye Intel wrote in a January 2026 analysis for 38 North, a leading North Korea research institute, the regime now functions as "a rogue crypto-superpower" with estimated Bitcoin holdings that may rank behind only the United States and China.
U.S. and UN officials now openly classify DPRK crypto theft as weapons of mass destruction financing. The stolen funds directly subsidize North Korea's nuclear and missile programs — a reality that transforms every permissionless swap into a potential sanctions violation.
The Bybit heist of February 21, 2025 was a masterclass in state-sponsored cybercrime execution. The Lazarus Group compromised a developer machine at Safe{Wallet}, injecting malicious JavaScript that modified transaction data only when Bybit's cold wallet was involved. CEO Ben Zhou signed what appeared to be a routine transfer. Within hours, 400,000 ETH — worth $1.5 billion — was gone.
What happened next was unprecedented in both speed and scale. Within two hours, the stolen ETH was distributed across 50 wallets, each receiving approximately 10,000 ETH. Within 48 hours, at least $160 million had been funneled through illicit channels. By March 4, 2025 — just 10 days later — the entire Ethereum haul had been laundered.
THORChain was the primary vehicle. Approximately $900 million of the stolen funds flowed through the protocol's cross-chain swap infrastructure. THORChain's node operators collectively earned $5.5 million in transaction fees from processing these swaps. The protocol's architecture — which allows permissionless, non-custodial cross-chain swaps without identity verification — made it an ideal laundering tool.
The internal conflict was revealing. When the scale of Lazarus activity became apparent, three THORChain validators voted to halt Ethereum trading. Within 30 minutes, four validators overturned the decision. The network continued processing swaps.
As MetaMask lead security researcher Taylor Monahan stated publicly: "Kim Jong Un sends his deepest gratitude to Thorchain, Asgardex, and eXch."
THORChain's situation has since deteriorated catastrophically. The protocol entered 2026 facing $200 million in unserviceable debt — $97 million in lending obligations and $102 million in saver and synthetic assets. Node validators voted to pause redemptions, 31 validators exited, and approximately $100 million in liquidity evaporated. The community voted to convert the debt into equity via a new token (TCY), and by late February 2026, RUNE traded at $0.41 — a shadow of its former valuation. The laundering controversy, the debt crisis, and the market downturn have converged into what may be a terminal spiral.
The legal framework for sanctioning permissionless protocols is in active flux, and the uncertainty creates a dangerous vacuum.
In November 2024, the Fifth Circuit Court of Appeals ruled that OFAC exceeded its authority by sanctioning Tornado Cash's immutable smart contracts, holding that autonomous code does not constitute "property" under the International Emergency Economic Powers Act (IEEPA). In March 2025, OFAC formally delisted Tornado Cash from its Specially Designated Nationals list.
This ruling drew a bright line: you can sanction people, but you cannot sanction code. Yet it left a critical question unanswered — what happens when identifiable individuals choose to operate infrastructure that facilitates sanctioned activity?
THORChain occupies a legally treacherous middle ground. Unlike Tornado Cash's immutable smart contracts, THORChain's node operators are identifiable, many are publicly known, and some reside in the United States. They made an affirmative decision to keep Ethereum trading active after learning that Lazarus Group was laundering $900 million through their network. As crypto legal consultant Yuriy Brisov of D&A Partners noted: "Thorchain's decentralised nature does not fully insulate it from the legal ramifications of facilitating illicit transactions."
The contrast with Chainflip is instructive. That protocol, which offers similar cross-chain swap functionality, partners with Elliptic to filter addresses based on risk scores linked to criminal or suspicious activity. THORChain enforces no censorship at the network level — a philosophical commitment that has become a legal liability.
Former Monero lead maintainer Riccardo Spagni has warned that profiting from Lazarus activity may trigger legal consequences, citing the prosecution of Tornado Cash developers as precedent. The German shutdown of eXch — a non-KYC exchange suspected of processing Lazarus funds via THORChain — demonstrates that regulators are already working their way up the laundering chain.
The broader crypto security picture in early 2026 remains alarming.
2025 in review: Total crypto theft reached $3.4 billion, according to Chainalysis — slightly above 2024's $3.3 billion. The top three hacks accounted for 69% of all service losses, with the largest attack being 1,000 times larger than the median incident. Personal wallet compromises surged to 158,000 incidents affecting 80,000 unique victims.
First major hack of 2026: On January 8, attackers exploited a pricing logic flaw in Truebit's bonding-curve smart contract, draining 8,535 ETH ($26.5 million). The same attacker had previously exploited the Sparkle protocol using an identical minting vulnerability — suggesting serial exploitation of legacy contract designs.
February 2026: CrossCurve's cross-chain bridge was exploited for approximately $3 million via spoofed cross-chain messages that bypassed gateway validation, affecting funds across Ethereum, Arbitrum, Optimism, Base, and five additional chains.
DPRK tactical evolution: North Korean attackers are increasingly embedding IT workers inside crypto firms or impersonating recruiters to harvest credentials — a social engineering approach that bypasses technical security entirely. Chainalysis data shows DPRK actors achieved record theft amounts with fewer confirmed incidents, indicating a deliberate shift toward higher-value, more sophisticated operations. Intelligence assessments indicate Pyongyang's cyber units have begun integrating large language models into reconnaissance, phishing, code analysis, and laundering operations.
Laundering preferences: DPRK actors distinctly favor Chinese-language money laundering services (355–1,000% more than other criminal actors), bridge services for cross-chain asset movement (+97% vs. baseline), and mixing protocols (+100%). They operate on approximately 45-day laundering cycles following major thefts — a cadence that has become a forensic signature.
The policy response is fragmenting along predictable lines.
U.S. Treasury actions: OFAC designated 8 individuals and 2 entities in November 2025 for laundering over $3 billion in cryptocurrency to fund DPRK's nuclear weapons program, targeting North Korean bankers and front companies including the Ryujong Credit Bank.
Legislative proposals: In January 2026, 38 North published an 11-point policy framework recommending that the U.S. classify all DPRK crypto theft as WMD financing, create a multinational "Crypto-PSI" coalition, impose baseline exchange security standards, and require continuous DPRK-IT-worker screening for federal contractors.
Industry self-regulation: The divide between compliant and non-compliant protocols is widening. Chainflip's integration of AML screening, BitGo's OCC national bank charter (December 2025), and Gemini's Nasdaq listing (September 2025) represent a professionalization wave. Meanwhile, permissionless protocols like THORChain face the market consequences of enabling illicit flows.
International coordination: South Korea is reviewing its sanctions framework following U.S. enforcement actions, and the EU sanctioned a North Korean individual tied to Lazarus for involvement in the Ukraine conflict — extending the enforcement perimeter beyond crypto into geopolitics.
DeFi security improvements: Despite the grim headlines, there is a counternarrative. Chainalysis notes that despite increased Total Value Locked, DeFi hack losses remained suppressed in 2024–2025, suggesting that improved security practices — including better smart contract auditing, formal verification, and bug bounty programs — are making a measurable difference at the protocol level.
North Korea is now the dominant threat actor in crypto, responsible for $2.02 billion in theft in 2025 (76% of all service compromises) and an estimated $6.75 billion cumulatively. This is no longer a fringe problem — it is a national security issue funding WMD programs.
THORChain's crisis illustrates the cost of permissionless absolutism. The protocol earned $5.5 million facilitating $900 million in Lazarus laundering while simultaneously accumulating $200 million in toxic debt. RUNE's collapse to $0.41 suggests the market is pricing in existential risk.
The Tornado Cash precedent protects code, not operators. THORChain's publicly identifiable node operators who voted to keep Ethereum trading active during the Bybit laundering may face legal exposure that immutable smart contracts do not.
The industry is bifurcating between protocols that embrace compliance infrastructure (Chainflip, institutional custodians) and those that refuse it. This split will likely accelerate as regulatory frameworks mature.
North Korea is integrating AI into its attack pipeline, increasing the sophistication and scale of social engineering, code analysis, and laundering operations — raising the bar for defensive measures across the industry.
The collision between state-sponsored crypto theft and permissionless DeFi infrastructure has moved from theoretical risk to documented reality. THORChain's willingness to process $900 million in Lazarus Group laundering — and its node operators' decision to override a pause on Ethereum trading — has become the defining case study of DeFi's compliance crisis.
The economic logic is unforgiving. THORChain earned $5.5 million in fees while enabling the laundering of funds that finance nuclear weapons programs. The protocol is now crippled by $200 million in debt, a collapsing token, and accelerating validator exits. The market is rendering its verdict before regulators do.
For the broader Web3 ecosystem, the lesson is structural: permissionless does not mean consequence-free. The Tornado Cash ruling established that autonomous code cannot be sanctioned, but it simultaneously highlighted that identifiable human operators cannot hide behind decentralization when they make affirmative choices to facilitate sanctioned activity. As North Korea's cyber capabilities grow more sophisticated — integrating AI, embedding operatives inside firms, and targeting ever-larger honeypots — the industry's tolerance for compliance-optional infrastructure will narrow.
The protocols that survive the next regulatory cycle will be those that solve the hardest design problem in DeFi: preserving permissionless access while implementing risk-proportionate screening at the infrastructure layer. Those that refuse will find that the market, the courts, and eventually OFAC will make the decision for them.