State-Sponsored Cybercrime and Cryptocurrency Theft

North Korea, known for its isolated and secretive regime under Kim Jong-un, has increasingly turned to sophisticated hacking to supplement its foreign currency earnings. The country’s detachment from global economic systems pushes it towards unconventional revenue sources, particularly through the theft of cryptocurrencies.

Recent Cyberattacks and Evidence of State Hacking

Experts, including those from TRM Labs, have linked the substantial $6.3 billion (£4.7 billion) hack of Binance to a specialized group within North Korea known as TraderTraitor, also identified as the Lazarus Group. Although the connection is not definitively proven, the operational pattern aligns with the group’s previous activities.

Historical Context of Cyber Activity

North Korea’s cyber assaults in the cryptocurrency sector began in 2017, focusing on taking advantage of the lax security protocols prevalent in this emerging field. These efforts aim to fund major initiatives, notably within the country’s military and nuclear weapons programs.

Currently, Kim Jong-un is believed to control a stockpile of approximately 50 nuclear warheads, and there are reports of North Korea supplying both personnel and weaponry to Russia amid its ongoing conflict in Ukraine. Alarmingly, the economic situation in North Korea is dire, with an estimated 40% of the population suffering from undernourishment.

UN Reports on Cyber Hacking Trends

A UN panel of experts reported in Spring 2024 that they are currently reviewing 58 suspected North Korean cyberattacks targeted at cryptocurrency companies between 2017 and 2023, with losses amounting to a staggering $3 billion. This cash flow is estimated to provide half of the country’s foreign income.

One unnamed nation has gone so far as to claim that the resources generated from these thefts provide up to 40% of the funding for North Korea’s weapons of mass destruction programs.

Rapidly Escalating Cyber Threats

In a worrying trend, North Korea reportedly executed 17 suspected cryptocurrency thefts in 2023 alone, with these incidents collectively valued at approximately $750 million. This trajectory of escalating thefts reached a peak in February 2025, when the FBI attributed a $1.5 billion hack of the Bybit exchange to TraderTraitor.

The Challenges of Cybersecurity in Cryptocurrency

Ciaran Martin, the former head of the UK’s National Cyber Security Centre, noted that North Korea has strategically targeted the cryptocurrency sector because it lacks the robust defenses that traditional banking institutions have developed. Martin highlighted, “Over the last decade, hackers have walked off with nine- or 10-figure sums from crypto hacks on more than 30 occasions. The number of traditional banks who have suffered a loss of more than $100m as a result of a cyber-attack in the same period is zero or one.”

Historical Precedents in Cybercrime

One of North Korea’s notable previous engagements in cyber theft involved a 2016 attack on Bangladesh Bank, where hackers attempted to illicitly transfer $951 million from the bank to various accounts around the world. They managed to successfully steal $81 million due to a fortuitous delay resulting from the routing of the funds, which raised suspicions.

This pattern of pursuing criminal activities highlights the lengths to which North Korea has gone to sustain itself financially, including high-profile forgery operations and the production of illicit drugs.

Targeting the UK and Domestic Cybersecurity Responses

The United Kingdom has generally been spared from direct attacks, experiencing limited exposure from North Korean hacking attempts. In 2019, a significant effort was made to infiltrate cash machines associated with 56 financial institutions, but British officials intervened to halt the operation before any funds were lost.

Internet Restrictions and Hacking Operations

Despite the severe restrictions on internet access within North Korea, where only a narrow segment of the population can connect, the state actively recruits talented students into hacker units like Lazarus that operate through the country’s Reconnaissance General Bureau. These groups are intricately tied to the regime’s overarching surveillance and control mechanisms.

Cultural Repercussions of Cyber Attacks

One notable incident illustrating the implications of North Korea’s cyber operations was the 2014 hack on Sony Pictures, prompted by the release of “The Interview,” a film that portrayed the assassination of Kim Jong-un. The attack resulted in the exposure of sensitive information and sparked significant controversy regarding censorship and freedom of expression.