State hackers backed by North Korea who have been targeting the cryptocurrency industry since January 2017 have netted an estimated US$3 billion.
Several groups, including Andariel, Lazarus Group and Kimsuky are also associated with non-crypto attacks against the liked of venture capital firms, alternative technologies and even individuals. However, cryptocurrency has delivered the biggest paydays, with an estimated US$1.7 billion in cryptocurrency, equivalent to 5% of North Korea's economy or 45% of its military budget, stolen in 2022 alone.
The loot, almost always laundered, is used to aid the regime's revenue so it could continue to function despite sanctions imposed by the international community. More specifically, cryptocurrency 'revenue' props up the regime's military funding and it may appear as coincidence that the amount of stolen cryptocurrency and number of missile launches have increased side by side.
The findings, revealed in a report by Recorded Future’s Insikt Group, showed the extent of the groups' activities, with 44% of stolen cryptocurrency in 2022 being attributed to them. As of August this year, North Korean-backed hackers had already stolen US$200 million in cryptocurrencies in 2023, ten times more than attacks by other hackers.
The report warns that the cryptocurrency industry, as well as traditional finance entities, should be vigilant. Stolen cryptocurrency is often converted into fiat currency, the value of which is derived from a country's promise to back it and not from physical commodities like gold or silver, and North Korean-backed threat actors evade anti-money laundering measures by using methods such as stolen identities and altered photos.
While much of North Korea's population starve, the regime's highly trained computer science professionals enjoy a privileged life with, among other things, access to technology and play a crucial role in conducting cyberattacks against the cryptocurrency industry.
