The myth regarding the security of cryptocurrencies has suffered another blow. North Korean hackers have once again deprived cryptocurrency owners of billions of dollars.

The myth of cryptocurrency security is taking another hit. North Korean hackers have once again cost cryptocurrency owners billions of dollars. Originally, cryptocurrencies were intended to serve as a safer, more independent alternative to traditional money and the banking system. However, the reality of recent years has revealed the darker side of digital currency—which has, almost incidentally, given rise to an entirely new realm of sophisticated crime.

Proponents of cryptocurrencies emphasize decentralization, cryptographic security, and independence from state institutions.

Yet, the reality of recent years also highlights the flip side of digital money. Hacker attacks, fraud, the misuse of access credentials, and breaches of cryptocurrency exchanges are costing holders vast sums of money.

Moreover, the latest incidents reveal that these attacks are increasingly being carried out by state-sponsored groups—actors that possess extraordinary technological capabilities and even leverage artificial intelligence. North Korea’s

Operation FaceStealer: Stolen Identities, Fake Video Calls, and Artificial Intelligence

On November 12, 2026, the U.S. Federal Bureau of Investigation (FBI) reported on an extensive hacking campaign by North Korean actors who, over the past 18 months, have stolen cryptocurrency worth more than $400 million. According to the U.S. Department of Justice, this operation—dubbed „FaceStealer“—primarily targeted individuals working in the cryptocurrency and technology sectors, as well as developers of open-source software.

A distinctive feature of this operation was the method the hackers used to gain their victims‘ trust. It did not primarily involve conventional breaches of cryptocurrency exchange security or direct attacks on a blockchain.

The attackers utilized compromised communication accounts belonging to real individuals to send out invitations for video conferences. Consequently, the victims believed they were interacting with acquaintances or business partners.

During the video calls, a simulated technical glitch—such as an audio issue—would occur. The victim would then be offered a solution, either via a link or by installing a supposed „fix“ program.

In reality, however, the victim was installing malicious software, which granted the attackers access to their data, accounts, and cryptocurrency assets.

Furthermore, the hackers employed pre-recorded footage of real people, as well as deepfake videos created using artificial intelligence. As part of the investigation, the FBI seized more than 900 video recordings captured via the victims‘ webcams.

The attackers did not necessarily use the access they gained immediately; in some instances, they waited several months—or even more than a year—before carrying out thefts.

U.S. authorities also announced the seizure of cloud infrastructure used in the operation. According to the FBI, „FaceStealer“ poses a growing threat not only to cryptocurrency holders but also to the security of the entire open-source software supply chain.

Another North Korean operation: Over six billion dollars vanished from the Binance exchange

A separate hacking attack on the cryptocurrency exchange Binance, which took place on October 29, 2026, was even larger in scale. The FBI has attributed this attack to a North Korean hacking group it identifies as „TraderTraitor.“

According to the FBI, more than six billion dollars‘ worth of digital assets were stolen from the exchange. The analytics firm Chainalysis estimated the scale of the attack at approximately 6.4 billion dollars, labeling it the largest cryptocurrency theft in history to date.

Unlike the FaceStealer operation, the attackers in this case targeted cryptocurrency infrastructure directly. They subsequently began converting the stolen assets primarily into Ether (ETH)—the cryptocurrency associated with the Ethereum blockchain network.

The next step involved fragmenting and moving the funds through decentralized finance (DeFi) services and exchanges, a process that can make it difficult to trace the origin of the assets. The case also demonstrates that, while blockchain transactions remain publicly recorded and can be analyzed retrospectively, tracking down and actually recovering stolen assets is significantly more complex.

U.S. authorities announced that, through joint interventions with private companies and cryptocurrency service providers, they have succeeded in freezing more than $2.7 billion in stolen funds. Subsequently, the U.S. Department of Justice obtained court authorization to seize or detain over $1.2 billion.

However, these figures represent various stages of securing stolen assets, rather than amounts that have already been returned to the victims. Investigations and efforts to locate additional funds are ongoing.

It is necessary to distinguish between the two North Korean operations. While FaceStealer primarily relied on social engineering, false identities, and malicious software, the TraderTraitor attack directly targeted the cryptocurrency exchange Binance.

Bybit: The Largest Cryptocurrency Theft Prior to the October Attack on Binance

The attack on Binance was not the first instance in which North Korean hackers managed to steal a massive quantity of digital assets from a major cryptocurrency platform.

In February 2025, the cryptocurrency exchange Bybit was targeted. The attackers gained control of one of its „cold wallets“—storage mechanisms used to keep cryptocurrencies offline, disconnected from the internet.

They subsequently stole approximately $1.5 billion worth of digital assets from the exchange, consisting primarily of Ether and other tokens linked to its ecosystem.

The FBI attributed the attack to the North Korean group TraderTraitor. According to available information, the attackers exploited the transaction approval process and manipulated the interface used to manage the cryptocurrency wallet.

Of particular interest is who ultimately bore the financial consequences. The stolen funds originated from a wallet managed by the exchange itself, rather than from the individual wallets of thousands of customers. Within 72 hours, Bybit replenished the missing reserves, and an independent audit confirmed that customer assets were once again backed on a 1:1 basis.

Consequently, individual customers did not directly bear the loss. The financial burden fell primarily on the exchange, which was required to replace the stolen assets.

Ronin Network: Robbed Users Eventually Compensated

The theft that occurred in March 2022—when hackers attacked the Ronin network, linked to the popular blockchain game Axie Infinity—followed a different course.

The attackers gained control over five of the nine validator nodes responsible for approving transactions on the network. This allowed them to authorize unauthorized withdrawals from the so-called Ronin Bridge, a mechanism that facilitated the transfer of digital assets between different blockchains.

A total of 173,600 Ether and $25.5 million worth of the cryptocurrency USDC were stolen. At the time of the attack, the total value of the stolen assets exceeded $620 million.

In this instance, individual users who held their cryptocurrencies within the system were directly affected. However, the network operator, Sky Mavis, decided to compensate for the losses.

While part of the funding was intended to come from an investment round led by the exchange Binance, the company later stated that it covered the necessary funds primarily from its own balance sheet and the personal resources of its founders.

In June 2022, the Ronin network announced the resumption of operations and full, 1:1 coverage of user funds. Consequently, customers did not ultimately lose their assets, even though their cryptocurrencies had indeed been stolen at the time of the incident.

Coincheck: Over Half a Billion Dollars Vanishes from Japanese Exchange

Another significant incident was the theft from the Japanese cryptocurrency exchange Coincheck in January 2018.

Hackers stole 526.3 million NEM (XEM) tokens, which were worth approximately $530 million at the time of the attack.
In this instance, customer funds stored in the exchange’s online wallet were targeted. The attack directly jeopardized the assets held in approximately 260,000 customer accounts.

Coincheck subsequently announced that it would provide financial reimbursement to affected clients using its own funds. This compensation was paid out in Japanese yen, based on a pre-determined exchange rate per stolen token.

Thus, in this case as well, customers did not ultimately bear the full financial loss. However, this reimbursement was not provided by an automated cryptocurrency deposit insurance system, but rather by the exchange operator itself.

Who actually loses out when cryptocurrencies are stolen?

These cases highlight an important distinction between the theft of digital assets and the ultimate financial loss suffered by their owner.

When a hacker attacks an exchange or another custodian of cryptocurrencies, funds belonging to customers may be immediately stolen. Whether customers actually lose their assets in the end, however, also depends on the financial situation of the operator and their willingness to cover the damages.

In the cases of Bybit, Ronin, and Coincheck, the entities were ultimately able to replenish or compensate for the customer assets. However, it cannot be inferred from this that cryptocurrency exchanges have a general obligation to compensate for all losses resulting from hacking.

Furthermore, there is no universal protection system comparable to the European deposit insurance scheme for banks.

The situation can be even more critical for an individual cryptocurrency holder who uses their own digital wallet. If an attacker obtains the user’s private key and transfers the cryptocurrency to another address, the transaction may be practically irreversible.

The blockchain does not distinguish between a transfer initiated by the actual owner and one executed by a thief who has obtained the owner’s access credentials.

While the owner may attempt to track the funds, request that exchanges freeze them, or contact the police, they have no automatic right to compensation.

This highlights one of the most significant differences compared to traditional banking. A bank deposit represents a claim held by the client against the bank. If funds are stolen from a bank’s operational assets, it does not automatically extinguish the depositor’s claim.

Moreover, the European Union has an insurance system in place for eligible bank deposits, covering up to 100,000 euros per depositor per bank.

However, when using a personal cryptocurrency wallet, an individual effectively assumes the role of custodian of their own assets. If they lose their access keys—or if someone steals them—there may be no institution available to help rectify the loss.

Bitcoin, Ethereum, stablecoins: which cryptocurrencies are most frequently targeted?

Identifying the most frequently stolen cryptocurrency is not straightforward. Available statistics distinguish between the number of hacking incidents, the number of compromised wallets, the financial value of the stolen assets, and the specific blockchain networks involved.

According to the analytics firm Chainalysis, more than $3.4 billion was stolen from the cryptocurrency ecosystem in 2025. The attack on Bybit alone accounted for approximately $1.5 billion.

Attacks on individual wallets also account for a significant portion of these thefts. In 2025, Chainalysis recorded approximately 158,000 instances of compromised personal wallets, affecting at least 80,000 unique victims. The total value of funds stolen from individual holders is estimated to have reached $713 million.

In terms of specific assets, Bitcoin (BTC) and Ethereum (ETH) are the most prominent. Bitcoin accounts for a substantial share of the value stolen from personal wallets, while Ethereum is a frequent target due to its extensive ecosystem of decentralized applications, exchanges, and financial services.

Stablecoins—such as Tether (USDT) and USD Coin (USDC)—represent another notable category. Their value is pegged to the US dollar, meaning they are not subject to the same dramatic price fluctuations as Bitcoin or Ethereum.

However, it is precisely this liquidity and relative price stability that make them attractive to perpetrators looking to move and conceal the proceeds of theft.

Regarding personal wallets, Chainalysis recorded approximately 26,500 victims on the Solana network in 2025. In terms of the rate of attacks relative to the number of active wallets, Ethereum and Tron ranked among the riskier networks.

This is, therefore, not an issue confined to a single cryptocurrency; the risks extend across virtually the entire digital ecosystem.

Blockchain security is not the same as the security of an owner’s assets

Proponents of cryptocurrencies often highlight their decentralized nature. Indeed, a blockchain allows for the recording and verification of transactions without a central bank or any other institution governing the entire network. Furthermore, cryptographic security makes unauthorized tampering with the transaction database itself extremely difficult.

However, this does not mean that all services and devices used to manage cryptocurrencies are automatically secure.
A theft does not necessarily require breaching the blockchain itself. Often, it is sufficient to gain access to a private key, compromise a cryptocurrency exchange, exploit a software vulnerability, or trick a user into voluntarily providing the necessary information to an attacker.

Moreover, decentralization means there is no central institution to automatically reverse fraudulent transactions or guarantee the recovery of lost assets.

Cryptocurrencies also face another significant risk. While traditional state-issued currencies may lose purchasing power due to inflation and monetary policy, digital assets are additionally subject to substantial price volatility.

Although Bitcoin’s limited supply ensures it cannot be created at will by a central bank, this offers no guarantee of price stability in the market.

Independence from banks and states does not automatically equate to greater security; rather, it may shift the full burden of responsibility and risk directly onto the owner of the digital funds.

Thus, alongside their technological advantages, cryptocurrencies introduce a distinct form of financial uncertainty. While state-issued money can be devalued by inflation, cryptocurrencies can be lost entirely—whether through a hacker attack, fraud, the collapse of an exchange, or even a single mistake by the owner.

This is the flip side of the financial independence that digital currencies promised.