DPRK Hackers Avoid DeFi Lending Even as On-Chain Laundering Scales: Chainalysis

Hackers linked to the government of North Korea largely avoided using DeFi lending protocols to swap and obscure stolen cryptocurrency in 2025, even as they laundered record volumes.

According to a new report by blockchain forensics firm Chainalysis, hackers reportedly linked to the government of the Democratic People’s Republic of Korea (DPRK) stole at least $2.02 billion worth of crypto in 2025, bringing the cumulative total DPRK-linked losses to $6.75 billion.

Despite fewer confirmed incidents, DPRK-linked groups accounted for 76% of all service compromises, relying on large attacks followed by laundering cycles lasting roughly 45 days. When it comes to DeFi, the report shows a sharp divergence in how North Korean hackers operate compared with other threat actors.

Chainalysis said DPRK-linked actors used lending protocols far less than other criminals, with an 80% gap, suggesting they largely avoid these DeFi services.

Relative Trend

Eric Jardine, head of research at Chainalysis, said the pattern reflects relative preferences rather than a complete absence of DeFi use.

“It’s a relative trend, so other actors who are stealing funds leverage them more than DPRK-linked attackers by a significant degree. It doesn't mean that DPRK never uses them, but they have a demonstrable preference for other services for layering like mixers and bridges,” Jardine said in commentary to The Defiant.

Instead, North Korean hackers showed clear preferences for bridges, mixers, and “Chinese-language money laundering services with a 45-day laundering cycle following major thefts.”

Data from DefiLlama shows total value locked (TVL) in DeFi rose from about $50 billion in 2024 to nearly $175 billion by October, approaching 2021 highs, but hacking losses stayed low this year, Chainalysis noted in its report.

As the New York-headquartered firm explained, consistently lower hack rates despite growing TVL “suggest that DeFi protocols may be implementing more effective security measures compared to the 2020-2021 period.”