Thomas Daniels
The United Nations Security Council has disclosed that over the past seven years, North Korea has redirected approximately $3 billion of illicitly acquired cryptocurrency towards the development of weapons of mass destruction. The staggering sum was amassed through a series of sophisticated cyberattacks and fraud schemes orchestrated by North Korean hackers, predominantly targeting the global cryptocurrency ecosystem.
A recent investigation highlights the alarming tactics used by these hackers, who exploit social media to deceive cryptocurrency companies and affluent individuals. According to David Robinson, co-founder of cybersecurity firm Internet 2.0 and a former Australian Army Intelligence Officer, the extent of these operations poses a significant threat to consumers. “Consumers are at a huge risk from North Korean hackers,” Robinson remarked in an interview with Sky News. “They’ve stolen $3 billion to date, according to the UN.”
The UN Security Council’s sanctions committee conducted an extensive review, identifying 97 cyberattacks attributed to North Korean actors on cryptocurrency platforms between 2017 and 2024, culminating in losses amounting to $3.6 billion. Notably, Chainalysis reported that North Korean cybercriminals absconded with $400 million in 2021 alone, primarily in Ethereum (ETH).
Emerging Hacking Techniques
In May 2024, cybersecurity firm Kaspersky unearthed a novel malware variant dubbed “Durian,” employed by North Korean hackers to infiltrate cryptocurrency companies in South Korea. The Kimsuky group, a notorious North Korean hacking collective, utilized this malware in targeted attacks against two South Korean crypto firms, exploiting legitimate security software used exclusively by these companies.
Social Media Fraud
A core component of North Korea’s strategy involves leveraging social media to propagate fake profiles impersonating celebrities or professionals. These fraudulent identities are used to promote crypto scams, phishing links, and fraudulent schemes. The hackers deploy traditional crypto fraud methods, such as distributing malicious links through messages or comments that redirect victims to counterfeit crypto exchange websites.
Collaboration with Russia
Compounding the issue, there is growing evidence of collaboration between Russian crypto exchanges and North Korean hacking groups since 2021. This partnership has facilitated North Korea’s evasion of international monitoring, allowing stolen cryptocurrencies to be laundered through Russian platforms. Chainalysis has reported that North Korean entities frequently use these exchanges to obscure the origins of their illicit gains.
