North Korean Hackers Shift Tactics: From Infiltration to Launching Their Own Cryptocurrency Platforms in 2026

• How Are North Korean Hackers Adapting Their Crypto Strategies?
• The Bybit Hack: A Turning Point for North Korean Cybercrime
• Are North Korean Hackers Launching Their Own Crypto Products?
• How Are Stolen Funds Being Laundered?
• What Does This Mean for Crypto Security?
• Can the Crypto Industry Fight Back?
• FAQs: North Korean Hackers and Crypto Threats in 2026

North Korean cybercriminals are no longer just hacking crypto projects—they’re building their own. With a record $2 billion stolen in 2025 and tactics evolving, these hackers are now creating deceptive platforms like Tenexium to directly target users. This article dives into their new strategies, the alarming rise in crypto heists, and how investors can stay SAFE in an increasingly risky DeFi landscape.

How Are North Korean Hackers Adapting Their Crypto Strategies?

North Korean hackers have long been a thorn in the side of the cryptocurrency world, but their tactics are evolving. Gone are the days when they relied solely on infiltrating existing projects. Now, they’re launching their own platforms—like Tenexium—to lure unsuspecting users. According to Elliptic, these hackers stole nearly $2 billion in 2025 alone, with no signs of slowing down in 2026. Their methods? A mix of social engineering, sophisticated laundering techniques, and outright deception.

The Bybit Hack: A Turning Point for North Korean Cybercrime

The 2025 Bybit hack wasn’t just another heist—it was a game-changer. Nearly all of the stolen funds were laundered within six months using unprecedented methods: fake refund addresses, worthless tokens, and advanced mixing services. This $1 billion+ operation set a new standard for North Korean hackers, who’ve since maintained a relentless pace. By 2026, Elliptic reported a doubling in exploits compared to early 2025, with total damages potentially exceeding $6 billion. These funds are suspected to fuel North Korea’s nuclear and ballistic programs, adding a geopolitical twist to the financial chaos.

Are North Korean Hackers Launching Their Own Crypto Products?

Meet Tenexium: the first major crypto hack of 2026. This seemingly legitimate project on the Bittensor (TAO) network disappeared overnight, taking $2.5 million with it. Investigations suggest its “team” might have been North Korean operatives posing as developers—possibly even the founder. This case highlights a dangerous trend: hackers aren’t just stealing crypto; they’re creating entire ecosystems to scam users directly. As DeFi grows, so do the risks of interacting with unvetted platforms.

How Are Stolen Funds Being Laundered?

North Korean hackers have mastered the art of moving dirty money. After the Bybit breach, they employed a toolkit of laundering techniques that left investigators scrambling. Strategic use of refund addresses, sham tokens, and mixing services allowed them to clean over $1 billion swiftly. In 2026, their methods grew even more refined, with Elliptic noting a spike in complex transactions designed to obscure fund trails. For context, TradingView data shows suspicious activity spikes correlating with major hacks—proof that these groups are optimizing their cash-out strategies.

What Does This Mean for Crypto Security?

The rise of hacker-built platforms like Tenexium signals a new era of threats. Unlike traditional hacks targeting exchanges, these schemes prey on user trust in decentralized projects. The BTCC team emphasizes that while tech safeguards matter, human error remains the weakest link. Their advice? Stick to established DeFi hubs and verify teams thoroughly—because in today’s market, even a “neutral exchange protocol” could be a front for state-sponsored theft.

Can the Crypto Industry Fight Back?

Despite the sophistication of North Korean operations, their success often hinges on simple oversights: phishing clicks, unverified contracts, and FOMO-driven investments. While blockchain analytics firms like Elliptic are getting better at tracing stolen funds, prevention starts with users. As one analyst quipped, “If a project’s dev team won’t show their faces, maybe your wallet shouldn’t either.”

FAQs: North Korean Hackers and Crypto Threats in 2026

How much have North Korean hackers stolen in 2025-2026?

Elliptic reports $2 billion in confirmed hacks for 2025, with projections exceeding $6 billion total when including unrecovered funds.

What’s new about their tactics?

Instead of just hacking projects, they’re now creating fake platforms (e.g., Tenexium) to directly scam users.

Where do the stolen funds go?

Analysts suspect links to North Korea’s weapons programs, given the scale and laundering patterns.