North Korea–linked hackers stole more than $2 billion in cryptocurrency in 2025, the largest annual total on record, pushing the regime’s total crypto proceeds above $6 billion and fueling concerns about funding for nuclear and missile programs.

A Maryland man, Minh Phuong Ngoc Vong, was sentenced to 15 months in federal prison for conspiracy to commit wire fraud tied to helping North Korean operatives secure remote software development jobs at 13 U.S. companies using false credentials.

Vong’s operation earned him more than $970,000, with over $28,000 paid by a Virginia firm involved, and multiple firms subcontracted with him for U.S. government–related work.

Vong facilitated North Korean operatives by providing login access, devices, and identity documents, enabling remote work for projects including a Federal Aviation Administration contract.

Experts note a shift from exploiting technical flaws to leveraging social engineering and insider access, forming a coordinated strategy that combines insider infiltration with high‑value crypto theft to expand North Korea’s income and reach.

Vong used false credentials and enabled a North Korean operative to use his logins, devices, and identity documents to perform remote work from abroad, including on an FAA contract.

Payments to Vong exceeded $970,000, with some contracts paying over $28,000, reflecting the scale of the insider-assisted operation.

The case fits a broader pattern of insider access being exploited by North Korea to bolster cyber operations and crypto theft in 2025.

Major 2025 breaches attributed to North Korea include the Bybit hack at about $1.46 billion and attacks on LND.fi, WOO X, and Seedify, with analysts linking more than 30 other hacks to North Korean groups.