Crypto glossary
State-sponsored crypto hacking
State-sponsored crypto hacking refers to attacks on exchanges, bridges and crypto firms carried out by groups working for a government, chiefly North Korea.
The best-documented actors are North Korean units often grouped under the name Lazarus, which US and UN investigators say steal crypto to fund the regime. Their methods rely less on exotic code bugs than on people: fake recruiters sending booby-trapped job tests, poisoned software packages, compromised developer laptops and long social engineering campaigns that end with control of signing keys or infrastructure.
These groups are behind some of the largest thefts in crypto history, including the 2022 Ronin bridge hack, which started with a fake job offer to an engineer, and the 2025 Bybit theft, which the FBI attributed to North Korea. Their laundering playbook is well known: rapid swaps to ETH or BTC, bridges, mixers and OTC brokers, which is why sanctions authorities have targeted services that handled the proceeds.
Attribution comes from governments and analytics firms and is not always public in detail. For companies, the lesson is that hiring processes, developer machines and multisig signers are part of the attack surface, not just smart contracts.
Example
A bridge developer accepts a well-paid job offer on a professional network, opens a PDF sent as part of the interview and installs malware that later lets the attackers sign withdrawals with stolen validator keys.
Related terms
Latest articles on State-sponsored crypto hacking
- North Korea Rejects FBI $6.3B Binance Hack Findings Citing US Bias
- FBI Attributes $6B+ Binance Theft to North Korea as Withdrawals Resume
- Bitget Blames North Korea for $352M Hack Via Spoofed Transfers, CEO Says
- North Korea Turns to Crime Networks for Crypto Laundering, RUSI Says
- North Korea’s Kimsuky Uses Local AI to Target Crypto and Financial Firms