G7 renews push against North Korea hacks

TLDR

G7 leaders have made North Koreas state-backed crypto hacking a collective security priority, linking stolen funds directly to weapons programs.

1. The G7 issued a joint statement from Evian pledging coordinated action against DPRK crypto thefts and related cybercrime.
2. North Korean groups are blamed for around $2 billion stolen in 2025 alone and over $6.75 billion cumulatively across major exchange and DeFi exploits.
3. Expect more wallet screening, sanctions pressure, and compliance obligations for exchanges and DeFi interfaces rather than immediate bans on normal users.

Deep Dive

1. What The G7 Actually Did

At the Evian G7 summit, leaders agreed a joint communiqu that singles out North Koreas crypto hacking as a weapons financing threat and calls for joint action against these operations. The statement ties DPRK crypto theft to funding nuclear and ballistic missile programs, citing United Nations and cybersecurity reports, and frames it as a global security risk rather than just a financial crime issue. However, the text is high level and does not yet spell out specific tools such as new sanctions lists, mandatory exchange controls, or mixing service bans, leaving implementation details to individual members and follow on working groups.

2. Scale And Style Of DPRK Crypto Theft

Analytics firms like Chainalysis estimate North Korea linked hackers stole at least $2 billion in crypto during 2025, bringing total suspected DPRK crypto thefts to at least $6.75 billion since 2017, with some estimates closer to $7.35 billion by 2026. Recent incidents attributed or strongly linked to North Korean actors include the roughly $1.5 billion Bybit hack, the $285 million Drift Protocol exploit and the $36 million Humanity Protocol breach, alongside earlier bridge and DeFi attacks. Threat groups such as Lazarus and TraderTraitor increasingly use social engineering, fake recruiters, and embedded IT workers at crypto firms to gain privileged access, then rapidly convert stolen assets and launder them through Bitcoin, mixers, and cross chain routes.

3. What Changes For Exchanges, Protocols And Users

The G7 language points toward three main levers. First, tighter sharing of intelligence on DPRK linked wallets, making it more likely that centralized exchanges and custodians will block or freeze flows connected to known addresses. Second, stronger enforcement of existing sanctions, including potential secondary sanctions on entities that knowingly help launder North Korean funds, which could increase pressure on mixers, OTC desks, and lightly regulated venues. Third, higher expectations that virtual asset service providers use on chain analytics and enhanced due diligence to detect state backed hacking flows, especially around big exploits.

Conclusion

G7 governments are explicitly treating North Koreas crypto hacking operations as a strategic threat that finances weapons programs, not just opportunistic cybercrime. The immediate move is political signaling, but it prepares the ground for stricter wallet screening, sanctions enforcement, and compliance expectations that will shape how exchanges and DeFi front ends handle suspicious flows, especially after large exploits.