Chainalysis: Crypto Hacking Slows as North Korea Redirects Resources

The total value stolen in crypto hacks reached $2.2 billion in 2024, a figure that was higher than the $1.8 billion taken in 2023 but lower than the record $3.7 billion stolen in 2022.

While the intensity of crypto hacking increased in the first half of 2024, it “slowed considerably” in July and remained relatively steady after that, blockchain data platform Chainalysis said in a Thursday (Dec. 19) report.

The report said a possible reason for the slowdown is that hackers affiliated with North Korea (DPRK) — who have been responsible for most of the large exploits over the last three years — reduced their hacking activities in the third and fourth quarters.

North Korea signed a mutual defense pact with Russia in June that included Russia releasing millions of dollars in North Korean assets that had been frozen in compliance with United Nations Security Council (UNSC) sanctions, according to the report.

“It is therefore possible that, in addition to redirecting military resources toward the conflict in Ukraine, the DPRK — which has dramatically increased its cooperation with Russia in recent years — may have altered its cybercriminal activity as well,” the report said.

The past year also saw a shift in hackers’ focus from decentralized finance (DeFi) platforms — which were the primary targets of crypto hacks between 2021 and 2023 — to centralized services, per the report.

The year also saw private key compromises become common in hacks, with 43.8% of the cryptocurrency stolen in 2024 being taken by exploiting this mechanism, according to the report.

The resurgence of crypto theft in 2024 highlights gaps in existing security measures, per the report.

“To combat these challenges effectively, a collaborative approach between the public and private sectors is essential,” the report said. “Data-sharing initiatives, real-time security solutions, advanced tracing tools and targeted training can empower stakeholders to quickly identify and neutralize malicious actors while building the resilience needed to safeguard crypto assets.”

The release of this report came a day after Chainalysis said it acquired Hexagate, security provider to companies like Coinbase and Consensys, to “expand our business beyond investigations and into prevention.”

Hexagate offers a suite of services for monitoring, mitigation, forensics and compliance.