North Korean Hackers Steal Billions Through Cryptocurrency Theft and Fraudulent Tech Employment

North Korea's cyber operations have diverged significantly from those of China and Russia, with Pyongyang primarily deploying its digital capabilities to generate funding for its government.

According to an extensive international report examining North Korea's cyber capabilities, hackers from the nation have amassed billions of dollars through cryptocurrency exchange breaches and by creating fraudulent identities to secure remote technology positions at foreign companies.

The 138-page assessment, published by the Multilateral Sanctions Monitoring Team comprising the United States and 10 allied nations established last year to monitor North Korea's adherence to UN sanctions, found that Pyongyang officials orchestrated these covert operations to finance nuclear weapons research and development.

The report details how North Korea has utilized cryptocurrency for money laundering and military acquisitions to circumvent international sanctions related to its nuclear program. It documents how North Korean hackers have targeted foreign enterprises and organizations with malware specifically designed to disrupt networks and extract sensitive information.

Despite its geographical limitations and isolation, North Korea has made substantial investments in offensive cyber capabilities. The investigators concluded that North Korea now competes with China and Russia in terms of hacker sophistication and capabilities, presenting a significant threat to foreign governments, businesses, and individuals worldwide.

Unlike cyber operations from China, Russia, and Iran, North Korea has concentrated its digital efforts on funding its government, employing cyberattacks and fictitious workers to steal from and defraud companies and organizations globally.

Supported in part by allies in Russia and China, North Korea's cyber activities have "been directly linked to the destruction of physical computer equipment, endangerment of human lives, private citizens' loss of assets and property, and funding for the DPRK's unlawful weapons of mass destruction and ballistic missile programs," states the report, using the acronym for North Korea's official name, the Democratic People's Republic of Korea.

The monitoring group consists of the United States, Australia, Canada, France, Germany, Italy, Japan, the Netherlands, New Zealand, South Korea, and the United Kingdom. It was formed last year after Russia vetoed a resolution directing a UN Security Council panel of experts to monitor Pyongyang's activities. The team's initial report, released in May, examined North Korea's military support for Russia.

Earlier this year, hackers with links to North Korea executed one of the largest cryptocurrency heists in history, stealing $1.5 billion worth of ethereum from Bybit. The FBI subsequently connected the theft to a group of hackers working for North Korea's intelligence service.

Federal authorities have also claimed that thousands of IT workers employed by US companies were actually North Koreans using fabricated identities to secure remote work. These workers gained access to internal systems and channeled their salaries back to North Korea's government. In some instances, these workers simultaneously held multiple remote positions.

A message left with North Korea's mission to the UN received no immediate response on Wednesday.