North Korea steals $2.8B in 2 years – Here’s what U.S. Treasury wants to do

ambcryptoPublished on 2026-03-09Last updated on 2026-03-09

Abstract

The U.S. Treasury is intensifying efforts to combat illicit financial activities involving digital assets, as highlighted in a report under the GENIUS Act. The study identifies significant risks, particularly with stablecoins, which accounted for 84% of illicit crypto transactions in 2025. The Treasury recommends enhanced monitoring using AI and real-time blockchain analytics, and proposes treating major stablecoin issuers like regulated financial institutions. The report also underscores growing threats from state-backed actors, notably North Korea, which stole an estimated $2.8 billion in crypto over two years to fund weapons programs. These findings support legislative push for acts like the CLARITY Act to establish clearer regulatory frameworks for digital assets.

As digital asset adoption grows, regulators are increasing efforts to prevent illicit financial activity, and in this U.S. Treasury has made a bold move.

Under the GENIUS Act, the U.S. Treasury was tasked with studying tools to detect illicit activity involving digital assets. As a part of the process, the Treasury reviewed industry feedback and examined technologies such as AI, digital identity, blockchain analytics, and APIs.

In this, they also found the risks linked to digital assets. These included the misuse of mixers, distributed ledgers, and DeFi, while outlining measures to combat illicit crypto finance.

Stablecoins take centre stage from a regulatory point of view

Seeing such setbacks, the report calls for stronger monitoring of the crypto ecosystem, particularly stablecoins. Treasury data shows stablecoins accounted for about 84% of illicit crypto transaction volume in 2025, making them a key focus for regulators.

To address this risk, the Treasury proposes AI-powered monitoring tools and real-time blockchain analytics to track transactions involving unhosted wallets and decentralized platforms.

Under this framework, major stablecoin issuers could be treated more like regulated financial institutions with stricter compliance requirements.

Remarking on the same, Galaxy Research Head Alex Thorn also weighed in,

Rising criminal and state-backed threats

Beyond regulation, the report also highlighted the growing scale of cybercrime and state-backed activity in the crypto sector.

One major concern came from North Korea, which emerged as one of the most aggressive cyber actors targeting the industry.

Using advanced hacking and social engineering tactics, North Korean groups stole $1.5 billion in crypto in early 2025, bringing their estimated total to $2.8 billion over the past two years, reportedly used to fund weapons programs.

At the same time, online scams are also expanding rapidly.

This highlights how the Treasury’s findings are closely tied to the proposed CLARITY Act, which aims to create clearer regulatory rules for digital assets rather than forcing crypto into traditional banking frameworks.

The need for tighter oversight

Additionally, the 2026 Chainalysis report recently highlighted how sanctioned entities moved around $104 billion through cryptocurrency in 2025, representing a massive 694% increase from the previous year.

Together, these findings deepen the Treasury’s concerns and may push lawmakers toward advancing legislation like the CLARITY Act.


Final Summary

  • With stablecoins linked to a large share of illicit transactions, regulators are prioritizing stricter oversight of issuers and transaction flows.
  • North Korean hacks, global scams, and sanctions evasion highlight how crypto is increasingly tied to international security concerns.

Related Reads

Bitcoin Withdrawals Continue: 8 Years of Storage in a Coldcard Cold Wallet Ended in Zero

Coldcard Hardware Wallet Hacked: Losses Mount Due to Vulnerable Seed Generation A critical vulnerability in Coldcard hardware wallets has led to a continued wave of fund thefts. According to Galaxy Research, the total stolen has reached 1,367.05 BTC (approx. $88.6 million) from 4,585 addresses, a significant increase from the initial 594.5 BTC reported on July 30, 2026. Most of the stolen funds remain on the attackers' addresses. The issue is not with the current firmware, which Coinkite has updated, but with seed phrases generated on vulnerable devices between March 2021 and the release of fixed firmware versions. Due to a programmer error, devices switched from using a hardware random number generator to the software-based Yasmarang generator, which was initialized with publicly accessible data like the chip's serial number. This made the seed phrases predictable through offline brute-force attacks, meaning wallets remain at risk until funds are moved to a new wallet generated with the patched firmware. Affected devices include Mk2/Mk3 with firmware 4.0.1–4.1.9 (and up to 5.0.3), Mk4/Mk5 up to version 5.6.0, and Q models up to 1.5.0Q. The only exceptions are seeds created with a high-entropy method like at least 50 independent dice rolls or a strong unique BIP-39 passphrase. All other owners must generate a new seed on the fixed firmware and transfer their assets. A case highlighting the human impact involves a 39-year-old long-term investor who lost 2 BTC (approx. $130,000) in minutes. He had accumulated the Bitcoin over eight years through physical labor, viewing it as a financial lifeline and a retirement plan in a country suffering from hyperinflation. His story underscores that even conservative "buy and hold in cold storage" strategies can be compromised by such underlying technical flaws. From a technical perspective, this incident echoes historical failures where weak random number generators undermined cryptographic security, challenging the assumption that offline storage is automatically foolproof.

cryptonews.ru46m ago

Bitcoin Withdrawals Continue: 8 Years of Storage in a Coldcard Cold Wallet Ended in Zero

cryptonews.ru46m ago

Trading

Spot
活动图片