North Korean Crypto Hacks Help Evade Sanctions and Put Markets at Risk
Crypto theft has become a major source of cash for Kim Jong Un’s government, according to a recent Bloomberg assessment. North Korean hackers have reportedly stolen billions, handing Pyongyang a route around international sanctions. My take: crypto markets face two immediate threats. Stolen coins can be dumped without warning. Regulators also have fresh grounds to tighten exchange security and KYC/AML rules. Why does this matter? Because either response could drain liquidity from Bitcoin (BTC) and Ethereum (ETH).
North Korea reportedly collected as much as $22 billion in foreign currency between 2022 and 2025, nearly four times what it made during the previous four years. Attacks on crypto exchanges and Web3 projects supplied much of that money. TRM Labs estimates that North Korean hackers stole roughly 66% of all cryptocurrency taken during the first half of 2026. That number is hard to shrug off. The money often moves through Chinese criminal networks before reaching the state, giving Pyongyang another route while sanctions keep it out of much of the international banking system. Still, the obvious conclusion is only half right: hacking was not North Korea’s largest reported source of foreign currency. Military cooperation with Russia produced an estimated $14 billion. I’ll be honest: that comparison changes the scale of the story.
The thefts also weaken crypto’s reputation as a safe haven during political turmoil. Bitcoin gained 8% around the January 2020 strike that killed Iranian general Qasem Soleimani. State-backed hacking creates a very different shock. Assets marketed as secure and decentralized are helping fund a sanctioned government, and the stolen coins do not simply vanish. They remain available for hackers or their intermediaries to sell. A sale of 10,000 BTC during thin trading could drive prices down quickly. Brief does not mean harmless. Such a decline could still push Bitcoin below support near $60,000, setting off leveraged liquidations.
Regulators will use this as ammunition. Of course they will. Honestly, what else would anyone expect when a sanctioned state raises money through crypto theft? The SEC and CFTC have already stepped up their scrutiny of exchanges and DeFi protocols. North Korea’s activity will add pressure for stricter identity checks and regular security audits. Wallets connected to previous attacks may be blocked, too. Stablecoin issuers and exchanges such as Coinbase (COIN) may also be pushed to trace stolen funds, then freeze them sooner. Counter to the industry’s usual framing, this is no longer just a compliance debate. Policymakers will probably treat it as a national security problem, leaving less room to argue for experimentation. The dispute over whether some tokens are securities could become more heated as well, especially if regulators connect weak oversight with state-sponsored theft.
What this means
North Korea’s hacking campaign exposes a blunt weakness in the digital asset market: one breach at an exchange or protocol can return an enormous batch of stolen tokens to circulation. Crypto firms need stronger security. They also need better coordination with law enforcement, though neither change happens quickly. Is that enough? Not immediately, because every new attack gives users another reason to distrust specific projects—and DeFi more broadly. I wouldn’t treat that distrust as irrational. ETH and DeFi tokens could swing harder when stolen funds begin moving, particularly if those transfers coincide with new enforcement action.
Traders should watch the Treasury Department and FinCEN for sanctions guidance or rules targeting exchanges. But waiting for regulators is only half a strategy. On-chain activity can provide an earlier warning: large transfers from addresses connected to previous hacks may indicate that stolen assets are about to be sold. I would pay closest attention when several of those wallets move funds within a few hours. One transfer can be noise. A cluster says more. Bitcoin’s $58,000 area is also worth watching. If the price remains below it, the market may be reacting to forced sales or fear of tighter regulation. It could be some mix of the two.