Threat actors linked to the Democratic People’s Republic of Korea (also known as North Korea) looted at least $600 million worth of cryptocurrencies in 2023.
Blockchain analytics firm TRM Labs said last week that the DPRK “was responsible for nearly a third of all funds stolen in cryptocurrency attacks last year, though a 30% decline from the US$850 million in 2022.”
“Intrusions committed by the Democratic People’s Republic of Korea were on average ten times as damaging as those that were not linked to North Korea.”
There are indications of this Additional violations Targeting the cryptocurrency sector by the end of 2023 could raise this number to around $700 million.
Targeting cryptocurrency companies is nothing new for state-sponsored actors in North Korea, which have stolen about $3 billion since 2017.
These financially motivated attacks are seen as a critical revenue-generating mechanism for the sanctioned state, financing weapons of mass destruction and ballistic missile programmes.
Intrusions leverage social engineering to attract targets and typically aim to compromise private keys and seed phrases—which are used to protect digital wallets—and then use them to gain unauthorized access to victims’ assets and move them to wallets under the control of the threat actor. .
“They are then mostly swapped for USDT or Tron and converted into hard currency using high-volume OTC brokers,” TRM Labs said.
The company also noted that North Korean hackers continued to explore other money laundering tools after the US Treasury sanctioned a cryptocurrency mixing service known as Sinbad for processing a significant portion of their proceeds, indicating continued development despite law enforcement pressure.
“With nearly $1.5 billion stolen in the past two years alone, North Korea’s hacking prowess requires continued vigilance and innovation from companies and governments,” TRM Labs said.