CertiK report: North Korean hackers account for approximately 60% of digital asset thefts by 2025, with attack patterns shifting towards "offline infiltration."

ChainCatcher reports that Web3 security company CertiK has released the "Skynet North Korean Crypto Threat Report." Data shows that since 2016, North Korean hacking groups have stolen approximately $6.75 billion in digital assets. In 2025 alone, their thefts resulted in losses of $2.06 billion, accounting for nearly 60% of the global crypto industry's total annual losses (including the $1.5 billion Bybit theft). As of early 2026, this threat trend continues, accounting for approximately 55% of the total losses. The report emphasizes that North Korean hackers' attack patterns have fundamentally changed, evolving from simple code vulnerability exploitation to a state-level attack system combining social engineering, deep supply chain attacks, and "physical penetration." In the recent Drift protocol incident, attackers even spent six months infiltrating offline industry conferences, building trust through real funds and interpersonal interactions before launching their attack. CertiK security experts warn that against this level of systemic attack, simple technical defenses are insufficient. Crypto institutions urgently need to fully implement the "zero trust" recruitment model, strengthen third-party supply chains, set up fund circuit breaker mechanisms, and work with professional security institutions to build a full lifecycle defense system covering code auditing, 24/7 risk monitoring, and on-chain anti-money laundering/KYT (Know Your Transaction) fund tracking.