G7 leaders have renewed calls for joint action against North Korea’s cryptocurrency thefts and cybercrimes. Summary G7 leaders linked North Korea crypto theft and cybercrime to wider nuclear and missile concerns. Chainalysis estimated DPRK hackers stole $2.02 billion in crypto in 2025 alone through attacks globally. The G7 statement urged joint action but did not name new sanctions or enforcement tools. The warning came in a geopolitical statement issued after the G7 summit in Evian-les-Bains, France. The leaders said they were deeply concerned about North Korea’s nuclear and ballistic missile programs. In the same statement, they said member nations needed to “jointly address North Korea’s cryptocurrency thefts and cybercrimes.” The statement did not name new sanctions, exchange rules, or crypto mixer controls. It also did not set out a timeline for fresh enforcement action against wallets, platforms, or intermediaries linked to stolen funds. Stolen crypto remains a funding concern The G7 warning follows years of reports that North Korea-linked hackers use stolen crypto to raise money under heavy sanctions. Western governments and blockchain analytics firms have long tied the activity to Pyongyang’s wider weapons program. According to Chainalysis, North Korean hackers stole at least $2.02 billion in crypto in 2025. The firm said that pushed the all-time total linked to DPRK actors to at least $6.75 billion. CrowdStrike also said DPRK-linked actors drove a 51% yearly rise in digital asset theft in 2025. Its 2026 financial services report said North Korea-linked groups used AI-generated identities, fake recruiters, and cloud access campaigns against crypto and financial firms. Rising attack scale As previously reported by crypto.news, North Korea-linked Lazarus attacks drained $577 million from Drift Protocol and KelpDAO in April 2026. Those two attacks accounted for most crypto theft reported that month. Crypto.news also reported that April became the worst month for crypto hacks in 2026, with more than $606 million stolen across 12 incidents in the first 18 days. The Drift and KelpDAO attacks made up nearly all of that loss. Those cases showed that attackers are moving beyond simple smart contract bugs. The methods included social engineering, compromised devices, bridge weaknesses, and signer manipulation. North Korea rejects the claims North Korea has denied U.S. and allied claims over cybercrime. In May, a Foreign Ministry spokesperson called the accusations “absurd slander” and said Washington was spreading false information for political reasons. The denial has not stopped governments and security firms from naming DPRK-linked groups as major crypto threats. CrowdStrike said North Korean actors use deception at scale, including fake identities and recruiter personas. The latest G7 statement keeps the issue on the diplomatic agenda, but it leaves open how member states plan to act. It does not say whether governments will tighten exchange screening, pursue new sanctions, or target laundering networks more aggressively.
