Chinese, N. Korean Threat Groups Build on Asia-Pacific Success

Cybercriminal and nation-state-linked groups—primarily associated with North Korea and China—are actively targeting financial firms and cryptocurrency assets across the Asia-Pacific region, using evolving social-engineering techniques (including recruiter impersonation and “pig butchering”), wallet and exchange thefts, and sophisticated money-laundering networks leveraging Chinese-language services, DeFi, mixers, and bridges. The report highlights large aggregated thefts (DPRK-linked groups stole at least $2.02 billion in 2025; notable incidents include a $1.5 billion ByBit theft), thousands of wallet thefts, ongoing data-leak-and-ransom operations, and growing regional cooperation that has enabled seizures and restraints of hundreds of millions in cryptocurrency.