North Korean cybercriminals have upgraded their cryptocurrency theft operations with malicious tools that siphon off assets from crypto wallets, leveraging their proven phishing skills to rake in as much as $137 million in a single day, according to a U.S. cybersecurity firm.

In its “M-trends 2025 Report” released on Wednesday, Mandiant highlighted North Korean threat actors’ increasing use of cryptocurrency drainers to transfer vast amounts of money. These tools often blend social engineering tactics with self-executing and irreversible smart contracts that quickly drain virtual wallets after a targeted user unwittingly provides access.

The Google subsidiary explained