[Cheonja Column] 'Coin Great Thief' North Korea's Lazarus

On Shlomo Kapran Street in Tel Aviv, the capital of Israel, is the headquarters of Check Point, the world's largest cyber security company. It was founded in 1993, foreseeing the importance of cyber security at a time when people barely connected to the Internet via telephone lines and modems made their characteristic screeching noises. I had the opportunity to hear an explanation about the cyber security industry there. The staff devoted a long time to the North Korean hacker group, saying that most of the largest theft incidents in history are their doing.

North Korea's 'Lazarus Group' is thus notorious worldwide. In 2016 they stole $81 million from Bangladesh Bank. Their target amount had been $1 billion, but the system was cut off midway, limiting the damage to that extent. In the 2017 WannaCry ransomware incident, 150 countries around the world were affected. The most striking case was this February's theft of Ethereum worth $1.46 billion from Bybit, a cryptocurrency exchange headquartered in Dubai, the largest coin theft in history. North Korea's cryptocurrency thefts this year amount to $2 billion, and cumulatively exceed $6 billion. Its Bitcoin holdings rank third in the world after the United States and the United Kingdom, and are said to be greater than those of El Salvador, which designated Bitcoin as legal tender.

On the 27th, Lazarus has been pointed to as behind the 44.5 billion won hacking incident that occurred at Upbit, the country's largest virtual asset exchange. It happened on the exact same date as the 2019 Ethereum hacking incident worth 58 billion won. The incident occurred on the day that Upbit's parent company Dunamu and Naver Financial were merging. It was like sprinkling ash on a celebration—apparently they were thoroughly mocked by Lazarus.

The size of North Korea's military hackers, who select math and science prodigies and train them as hackers from elementary school, is estimated to reach 10,000. Our Ministry of National Defense's Cyber Operations Command has only about 1,000 personnel. Check Point was co-founded by three people from Unit 8200, an intelligence unit that Israel's top elites attend. Unit 8200 had the capability to participate in the Stuxnet virus attack that disabled thousands of uranium-enrichment centrifuges in Iran's nuclear facilities between 2005 and 2010. The world is not idle enough to turn cyber security into a partisan political battleground.

Yoon Sung-min, Senior Editorial Writer smyoon@hankyung.com