North Korea's Cryptocurrency Theft: The World Must Take Action

Yoo Dong-ryul

President of the Korea Institute of Liberal Democracy

On January 14 (U.S. local time), the U.S., South Korea, and Japan issued a joint statement on North Korea’s cyber theft of virtual assets. The statement linked North Korea to major heists last year, including $308 million from Japan's DMM Bitcoin, $235 million from India's WazirX, and $50 million each from South Korea’s Upbit and the U.S.'s Radiant Capital. In total, these thefts amounted to $660 million (approximately 960 billion Korean won). This marks the first time the three countries have jointly reported on North Korea's cybercrime activities.

The cybercrimes were carried out by well-known hacking groups, such as "Kimsuky" and "Lazarus," which belong to North Korea's elite cyber unit the "Technical Reconnaissance Bureau." The name "Kimsuky" was coined by the Russian cybersecurity firm "Kaspersky Lab" in 2013 while investigating North Korean hacking incidents, not by North Korea itself. This applies to the other group names as well.

"KimSuky" and "Lazarus" have consistently drawn the attention of international cybersecurity firms. On October 27, 2020, the US-CERT (U.S. Computer Emergency Readiness Team) released an analysis of Kimsuky's activities. Additionally, leading cybersecurity companies such as Symantec, FireEye, and Kaspersky Lab identified the group responsible for the 2014 Sony Pictures hack as "Lazarus."

Lazarus then shifted its focus to targeting financial institutions worldwide, successfully stealing $81 million from the Bangladesh central bank in 2016. In March 2022, the popular 'Play-to-Earn' game, Axie Infinity, was hacked, resulting in the theft of $173,000 worth of Ethereum, $25.5 million in USD Coin (USDC), and $625 million (about 812.5 billion KRW) in cryptocurrency, setting the world record for the largest single hack in history

In fact, North Korea's cyber theft of funds is not a recent development. Since the 2000s, South Korean and U.S. authorities, along with international cybersecurity firms, have consistently issued threat alerts. Currently, North Korea is responsible for 60.9% of global cryptocurrency theft, highlighting the country's exceptional hacking capabilities.

Since 2009, the UN Security Council Sanctions Committee on North Korea (active until 2024) issued annual reports on North Korea’s cyber threats. According to the expert panel's  April 5, 2023 report, North Korean hackers stole between $630 million (819 billion KRW) and $1 billion (1.3 trillion KRW) in cryptocurrency in 2022 alone.

As international sanctions on North Korea have tightened due to its nuclear and missile actions, traditional sources of foreign currency—such as exports, overseas workers, and arms trafficking—have been blocked. In response, North Korea has turned to cyber theft, targeting South Korea and the global community for revenue.

The reason North Korea focuses on cyber theft is clear: cyberspace offers a "low-cost, high-efficiency" way to generate revenue once hacking skills are developed. Unlike offline methods, it is hard to pinpoint the origin of attacks, and blockchain technology can be exploited to launder money and avoid detection.

During the Moon Jae-in administration, North Korea repeatedly hacked domestic cryptocurrency exchanges, causing over 200 billion KRW in losses. "Bithumb" was hacked four times between 2017 and 2019, losing 84 billion KRW. In 2017, "Youbit" lost 22.5 billion KRW after two hacks, leading to its bankruptcy and the CEO's tragic death. In 2019, "Upbit" lost 58 billion KRW.

In February 2023, the government sanctioned four North Korean individuals, including Park Jin-hyuk, and seven institutions, including the Reconnaissance General Bureau, along with eight cryptocurrency wallet addresses linked to the Lazarus hacking group.

Last year, in collaboration with the U.S., the government tracked and seized North Korean cryptocurrency accounts and money laundering routes, recovering stolen funds. It has also required cryptocurrency exchanges to adopt Anti-Money Laundering (AML) and Counter-Terrorism Financing (CFT) systems to freeze illegal funds linked to North Korea.

Despite international sanctions, North Korea continues to exploit cyberspace as a source of foreign currency Its methods range from cryptocurrency theft to illegal gambling and game program development, running illicit cyber gambling operations, DDoS attack services, and ransomware attacks.

Recently, North Korea has been using skilled IT workers, disguised as employees of foreign companies, to earn foreign currency and steal IT information. A related recommendation was included in the recent trilateral joint statement.

The international community must consider proactive measures to counter North Korea's increasingly aggressive cyberattacks, including cryptocurrency theft.

<Table> Recent Notable Cases of North Korea’s Cryptocurrency and Financial Theft

Source: Korea Institute of Liberal Democracy