North Korea steals billions of dollars in cryptocurrencies

North Korea has recently emerged as one of the largest holders of cryptocurrencies globally, with estimates suggesting it has stolen over $6 billion in the past decade, according to the Wall Street Journal.

One of the most significant thefts of digital assets took place in mid-July 2024, when hackers linked to North Korean dictator Kim Jong-un's regime stole over $200 million from WazirX, India's largest cryptocurrency exchange.

However, the most significant achievement by hackers associated with the North Korean government occurred last February, when they targeted the Bybit exchange, based in Dubai, United Arab Emirates. They made off with around $1.5 billion in cryptocurrencies, according to an FBI investigation. This incident has been classified as the largest digital asset theft in history.

The organization behind these and similar cyberattacks is the Lazarus Group, a hacker collective linked to North Korea.

The Wall Street Journal reported that, according to researchers, hackers often target the social media accounts of exchange platform employees, crafting personalized stories to deceive them into clicking on malicious links and logging in.

Some hackers have gone as far as securing jobs with U.S. companies, deceiving them into hiring them as remote workers to gain access to their networks.

Once hackers acquire the cryptocurrencies, they quickly distribute the funds to evade detection by authorities. They then lay low for months or even years, waiting until investigators lose interest, at which point they convert the digital assets into traditional currency, as explained by the Wall Street Journal.

This money helps fund North Korea's nuclear program and supports the country's economy, which has been impacted by international sanctions.

According to the U.S. newspaper, Kim Jong-un's regime oversees a group of more than 8,000 hackers involved in cyberattacks.

However, the North Korean government has not commented on the latest hacks and has denied responsibility for previous cyberattacks.