North Korean hackers stole approximately $2 billion worth of cryptocurrency this year, marking a record high and a roughly 1,300-fold increase over the past decade. Notably, the hackers achieved larger heists with fewer hacking attempts this year.
According to a cryptocurrency crime report recently published by Chainalysis, a U.S.-based blockchain data analytics firm, North Korean hackers stole $2.02 billion in cryptocurrency this year, up 51% from $1.3 billion last year. This represents the highest figure on record since Chainalysis began its analysis in 2016, when the amount stood at just $1.5 million—a surge of more than 1,333-fold over nine years.
North Korea accounted for 76% of the $3.4 billion in global cryptocurrency theft incidents carried out by hackers worldwide from the beginning of this year through early this month, the highest share among all actors.
Chainalysis estimates that the cumulative value of cryptocurrency stolen by North Korea to date is at least $6.75 billion.
"North Korea represents the most serious state-level threat to cryptocurrency security," Chainalysis said. "Despite a sharp decline in attack frequency this year, it has been a record year in terms of stolen amounts."
According to the report, North Korean hackers' primary method involves infiltrating IT staff into cryptocurrency service companies. They first secure access to internal systems before launching large-scale attacks.
"The record increase in North Korean attacks this year reflects a growing reliance on infiltrating IT personnel into exchanges, custodians, and Web3 companies," the report said. "This allows them to accelerate initial access and internal proliferation ahead of large-scale hacking attacks."
The hackers also approach targets by posing as investors or acquirers, extracting sensitive system information and infrastructure access during fake investment meetings or due diligence processes.
North Korean hackers demonstrated more covert and sophisticated methods than typical hackers when laundering stolen cryptocurrency. While general hacking-related money launderers transfer more than 60% of funds in amounts ranging from $1 million to $10 million, North Korean hackers transferred over 60% of stolen funds in smaller increments of less than $500,000.
The report noted that North Korean actors utilize cross-chain bridges to complicate asset tracking across blockchains and frequently use Chinese-language fund transfer and escrow services. The money laundering process is typically completed within approximately 45 days.
"These patterns suggest that North Korea operates under different constraints and objectives than non-state-sponsored cybercriminals," the report said. "North Korea's intensive use of Chinese-language money laundering services and over-the-counter trading platforms indicates that North Korean threat actors are closely linked to illicit actors throughout the Asia-Pacific region."
"North Korea consistently carries out attacks on a much larger scale compared to other threat actors," the report added. "It is clear that North Korean hackers aim to inflict maximum damage by targeting large-scale services."
