North Korea stole $577M in crypto hacks in April alone, TRM Labs data shows

Brooks argued the scale demands a different posture from security teams and protocol designers. A $300 million theft from a single protocol is not a counterparty risk that insurance can manage. It is a state-level threat. That means tighter KYC and AML on exchange flows, deeper vetting of bridge contracts, and treating social engineering as a systemic risk rather than a one-off user error.

The industry's reflex is to treat each hack as an isolated security failure. Brooks's point is that the pattern itself is the threat. The DPRK does not steal crypto for profit. It steals to fund a weapons program that the United Nations has sanctioned for decades. Every dollar that flows to Pyongyang through a bridge exploit or a social engineering campaign extends the regime's reach.

"They are building a nuclear weapons system with the money that they hack from crypto," Brooks said on the podcast.

Traders and investors should watch for regulatory responses. If the U.S. Treasury or OFAC intensifies scrutiny of protocols that handled stolen funds, the compliance burden could shift. Exchanges that process withdrawals from affected addresses may face sanctions risk. The next 12 months will test whether the industry can build defenses that match the sophistication of a state actor, not just generic script kiddies.

Brooks's closing line was blunt: "The crypto industry has a North Korea problem. It's time to stop calling it something else."