CrowdStrike’s 2026 Financial Services Threat Landscape Report says North Korea-linked hackers stole $2.02 billion in crypto in 2025, a 51% jump from 2024.
The findings frame Democratic People’s Republic of Korea (DPRK) operations as a key threat to crypto and fintech firms, with stolen funds reportedly routed to the regime’s military programs.
North Korean Threat Actors Intensify AI-Driven Attacks
The report stated that North Korea-linked cyber groups increasingly leveraged artificial intelligence to expand operations targeting the financial sector. FAMOUS CHOLLIMA reportedly doubled its activity by using AI-generated identities to infiltrate crypto exchanges, fintech firms, and retail banks.
Meanwhile, STARDUST CHOLLIMA employed AI-created recruiter profiles and fabricated video meeting environments to target fintech companies across North America, Europe, and Asia.
“Financial services organizations face threats from every direction and AI is making each of them harder to stop. The cost to create convincing identities, automate reconnaissance, and accelerate credential theft is near zero,” Adam Meyers, head of counter adversary operations at CrowdStrike, said.
Follow us on X to get the latest news as it happens
Ransomware and Espionage Compound the Pressure
CrowdStrike further counted 423 financial services victims on dedicated leak sites during the reporting period, a 27% annual increase. Hands-on-keyboard intrusions rose 43% globally, with North America posting a 48% spike.
Pressure has continued into 2026. The region accounted for over half of the sector intrusions in the first quarter of 2026.
Moreover, CrowdStrike said that by Q1 2026, the financial services industry had become the fourth-most-frequently targeted sector, accounting for 12% of all recorded activity.
TRM Labs also linked DPRK groups to roughly $577 million in stolen funds from Drift Protocol and KelpDAO through April. However, North Korea has rejected the cyber threat claims through its state news agency KCNA.
Subscribe to our YouTube channel to watch leaders and journalists provide expert insights
