News
North Korea laundered $147.5 million in stolen cryptocurrencies in March, UN experts say
By Michelle Nichols
UNITED NATIONS (Reuters) – North Korea laundered $147.5 million through virtual currency platform Tornado Cash in March after stealing it from a cryptocurrency exchange last year, according to confidential work by sanctions monitors. United Nations seen by Reuters on Tuesday.
The monitors told the U.N. Security Council’s sanctions committee in a document submitted Friday that they investigated 97 suspected North Korean cyberattacks against cryptocurrency companies between 2017 and 2024, worth about $3.6 billion. of dollars.
This included an attack late last year in which $147.5 million was stolen from cryptocurrency exchange HTX before being laundered in March this year, observers told the committee, citing information from the analytics firm cryptographic company PeckShield and blockchain research firm Elliptic.
In 2024 alone, observers said they looked at “11 cryptocurrency thefts… worth $54.7 million,” adding that many of these “may have been conducted by DPRK IT workers inadvertently hired by small companies related to cryptocurrencies”.
Observers said that North Korean IT workers operating abroad generate “substantial income for the country,” according to United Nations member states and private companies.
Formally known as the Democratic People’s Republic of Korea (DPRK), North Korea has been under United Nations sanctions since 2006, and those measures have been strengthened over the years in an effort to cut funding for its ballistic missile and nuclear programs.
North Korea’s mission to the United Nations in New York did not immediately respond to a request for comment.
The United States sanctioned Tornado Cash in 2022 for allegedly supporting North Korea. Two of its co-founders were charged in 2023 with facilitating more than $1 billion in money laundering, including on behalf of a cybercrime group linked to North Korea.
Lawyers for Tornado Cash co-founder Roman Storm, who pleaded not guilty to the U.S. charges in September, did not immediately respond to a request for comment.
The story continues
So-called virtual currency “mixer” platforms like Tornado Cash take many users’ cryptocurrencies and mix them together to help hide the source and owners of the funds.
The UN sanctions monitors were disbanded at the end of April after Russia vetoed the annual renewal of their mandate. Some of the observers presented unfinished work, which was shared with the Council’s sanctions committee on North Korea on Friday.
Traditionally, sanctions monitors’ reports are first agreed upon by all eight members. The unfinished work presented to the committee did not follow this process.
The observers said they were investigating a February 6 New York Times report that Russia had released $9 million of North Korea’s $30 million in frozen assets and allowed Pyongyang to open an account at a Russian bank in South Ossetia so that we can gain better access to international banking networks.
ILLEGAL WEAPONS, COAL
Observers also said ships suspected of involvement in the arms trade between North Korea and Russia continued voyages carrying containers between the North Korean port of Rajin and Russian ports, including Vladivostok and Vostochny.
Sanctions monitors said one vessel in particular, called the Angara, had been in the Chinese port of Ningbo since February, where it may have been undergoing maintenance. Reuters reported that China was providing mooring for the ship.
Russia’s mission to the United Nations in New York declined to comment on the observers’ work. China’s U.N. mission did not immediately respond to a request for comment.
The United States and other countries have accused North Korea of transferring weapons to Russia for use against Ukraine, which it invaded in February 2022. Both Moscow and Pyongyang have denied the accusations, but vowed last year to look further into military relations.
In a separate report last month, United Nations sanctions monitors told the Security Council that debris from a missile that landed in the Ukrainian city of Kharkiv on January 2 was from a North Korean Hwasong-11 series ballistic missile.
The United Nations Security Council has banned North Korean exports, including coal, iron ore, lead, textiles and seafood, and restricted imports of crude oil and refined petroleum products.
“North Korea and its enablers continue to evade sanctions through maritime means, including North Korea’s ongoing acquisition of vessels, the import of refined oil including via ship-to-ship transfer, and the export of coal,” the observers wrote.
The monitors said they investigated information from an unnamed member state about 208 trips by North Korean merchant ships to unload coal in Chinese coastal waters, adding that most were likely to have occurred via ship-to-ship transfers.
“Chinese Coast Guard vessels have been identified on several occasions in the vicinity of DPRK vessels suspected of discharging coal in Chinese waters,” the observers wrote.
China’s U.N. mission did not immediately respond to a request for comment.
(Reporting by Michelle Nichols; Editing by Don Durfee and Deepa Babington)