North Korea's Targeting of Cryptocurrency Industry

This technical report details North Korea's extensive targeting of the cryptocurrency industry, which has escalated since 2017, resulting in the theft of over $3 billion in cryptocurrency. The regime shifted its focus from traditional financial institutions to cryptocurrency during the 2017 market boom, leading to significant global operations. In 2022 alone, North Korean threat actors were responsible for stealing approximately $1.7 billion, which constitutes a substantial portion of the country's economy and military budget. The report outlines the methods employed by these actors, including the use of cryptocurrency mixers and cross-chain swaps to launder stolen assets. It emphasizes that the threat extends beyond exchanges to individual users and venture capital firms. The report also highlights the regime's ability to leverage advanced technology and skilled personnel for cyber operations, despite its isolation. Recommendations for cryptocurrency firms and traditional financial institutions include enhancing cybersecurity measures and employee training to mitigate risks associated with North Korean cyber threats.