North Korean Cyber Units Stole $6.75 Billion in Crypto Hacks to Fund Nuclear Program

Blockchain Analytics Firm Report

"North Korea Behind 66% of Global Crypto Hacks"

A string of hacking and data-breach incidents in South Korea's financial sector is raising concerns over cyber threats from North Korea. Analysts say security must be strengthened as Pyongyang has turned cyberattacks into a key source of foreign currency, stealing billions of dollars a year through cryptocurrency hacks and using the proceeds to support its nuclear and missile programs.

Blockchain analytics firm Chainalysis said on Oct. 29 that hacking groups linked to North Korea stole $2.02 billion in cryptocurrency last year, up 51% from a year earlier. It was the largest annual total on record, bringing the cumulative amount stolen to $6.75 billion.

Large-scale cryptocurrency theft has continued this year. TRM Labs estimated that about 66% of global losses from cryptocurrency hacks in the first half came from attacks linked to North Korea. A leading example was the roughly $1.5 billion hack of global cryptocurrency exchange Bybit in February last year. The FBI officially attributed the incident to a North Korean hacking group. Investigators believe the hackers dispersed the stolen assets across multiple wallets to evade tracking.

The proceeds from the hacks are believed to support North Korea's nuclear and missile development. In a report released in March, the U.S. Office of the Director of National Intelligence assessed that North Korea secures at least $1 billion a year through financial crimes including cryptocurrency theft and uses the funds for weapons development. Director of National Intelligence Tulsi Gabbard told a Senate Intelligence Committee hearing that about $2 billion stolen by North Korea last year was being used to sustain the regime and develop strategic weapons.

South Korea's financial sector has also been targeted before. The National Office of Investigation, the investigative arm of the Korean National Police Agency, concluded that the 2019 theft of Ethereum worth about $41.9 million from South Korean cryptocurrency exchange Upbit was carried out by Lazarus and Andariel, hacking groups under North Korea's Reconnaissance General Bureau.

The U.S. government is also tightening sanctions on North Korea's efforts to earn foreign currency through its information technology workers. The Treasury Department's Office of Foreign Assets Control imposed additional sanctions on 10 individuals and one entity involved in disguising North Korean IT workers for overseas employment and remitting illicit proceeds.

Kim Da-bin, Hankyung.com reporter davinci@hankyung.com