North Korean Hackers Stole $600 Million in Crypto in 2023

Hackers tied to North Korea stole at least USD 600 million in cryptocurrency in 2023, according to new research by TRM Labs. Additional hacks carried out in the final days of last year could, if confirmed to have been committed by North Korea, push this total to around USD 700 million.

The Democratic People’s Republic of Korea (DPRK) was responsible for almost a third of all funds stolen in crypto attacks last year, despite a 30% reduction from the USD 850 million haul in 2022. 

Hacks perpetrated by the DPRK were on average ten times as damaging as those not linked to North Korea. Nearly USD 3 billion worth of crypto has been lost to Pyongyang-linked threat actors since 2017.

North Korea conducts nearly all of its attacks by compromising private keys and seed phrases, which are critical security elements of digital wallets. Hackers transfer the victims’ digital assets to wallet addresses controlled by North Korean operatives. They are then swapped mostly for USDT or Tron and converted to hard currency using high-volume OTC brokers.

The DPRK’s money laundering methods constantly evolve to evade international law enforcement pressure. As US sanctions and enforcement actions targeted Tornado Cash and ChipMixer – its previous go-to obfuscation platforms – North Korea pivoted to another mixer it had already begun using, the BTC service Sinbad. After Sinbad was sanctioned by OFAC in November 2023, North Korea continued exploring other laundering tools.

With nearly USD 1.5 billion stolen in the past two years alone, North Korea’s hacking prowess demands continuous vigilance and innovation from business and governments. Despite notable advancements in cybersecurity among exchanges and increased international collaboration in tracking and recovering stolen funds, 2024 is likely to see further disruption from the world’s most prolific cyber-thief.