News
Crypto Country: North Korea Targets Cryptocurrency
In a new report, Recorded Future’s Insikt Group examines North Korea’s success in its cybercriminal operations against the cryptocurrency industry. Since 2017, North Korea has significantly increased its focus on the cryptocurrency industry, stealing an estimated $3 billion worth of cryptocurrencies. Initially successful in robbing financial institutions through hijacking the SWIFT network, North Korea shifted its focus to cryptocurrencies during the 2017 bubble, starting with the South Korean market and then expanding globally. In 2022 alone, North Korean threat actors were accused of stealing $1.7 billion in cryptocurrencies, equivalent to 5% of the country’s economy or 45% of its military budget. The stolen funds, often laundered using methods similar to traditional cybercriminal groups, contribute to the regime’s revenue, allowing it to operate despite international sanctions.
State-backed North Korean threat actors engage in operations that mirror those of other cybercriminal groups but operate on a larger scale, accounting for 44% of cryptocurrencies stolen in 2022. Targets include not only cryptocurrency exchanges cryptocurrency but also individual users, venture capital companies and alternative technologies. Those operating in the cryptocurrency industry, as well as traditional financial entities, are advised to exercise caution. Stolen cryptocurrency is often converted into fiat currency, and North Korean threat actors use various methods, including stolen identities and altered photos, to evade anti-money laundering measures.
The regime considers cryptocurrency theft to be a major source of revenue, particularly for financing military and weapons programs. While the exact amount used for ballistic missile launches is unclear, both the volume of stolen cryptocurrencies and missile launches have increased. Without stricter regulations, cybersecurity measures, and investments in cybersecurity for cryptocurrency companies, North Korea is likely to continue targeting the industry for additional revenue. Despite restrictions on movement and isolation of the general population, the regime elite and highly trained IT professionals with privileged access to technology play a crucial role in conducting cyberattacks against the cryptocurrency industry.
To read the full analysis, Click here to download the report in PDF format.