North Korea’s Multi-Billion Dollar Cryptocurrency Heists and Laundering Networks
The Democratic People’s Republic of Korea (DPRK) has evolved into one of the most sophisticated cyber threats to the global financial system. By combining aggressive hacking campaigns with fraudulent employment schemes, North Korea has stolen billions in cryptocurrency to fund its weapons of mass destruction (WMD) and weapons programs, systematically evading U.S. Sanctions.
The Escalating Scale of Cryptocurrency Theft
North Korean state-backed hacking groups have seen a dramatic increase in the value of their thefts over the last few years. According to blockchain analytics firm Chainalysis, the value stolen by North Korea-affiliated hackers rose from approximately $660.50 million across 20 incidents in 2023 to $1.34 billion across 47 incidents in 2024. By 2025, this figure reached a record $2 billion.
These gains are the result of targeted attacks on the blockchain industry. A joint statement from the United States, South Korea, and Japan highlighted several high-profile breaches, including:
- WazirX: A July 2024 breach of India’s largest Bitcoin exchange resulting in a $235 million loss.
- DMM Bitcoin: A heist totaling $308 million.
- Upbit: A theft of $50 million.
- Radiant Capital: A loss of $50 million.
- Rain Management: A theft of $16.13 million.
To achieve these breaches, the DPRK utilizes well-disguised social engineering attacks to deploy specialized malware, such as AppleJeus and TraderTraitor, targeting cryptocurrency industry companies.
The “IT Worker” Scheme: Infiltration and Espionage
Beyond direct hacking, North Korea employs a deceptive strategy of infiltrating foreign businesses. The U.S. Treasury has revealed that the DPRK places IT workers into U.S. And foreign companies using stolen identities and fake documents. These workers funnel the majority of their earnings back to Pyongyang to fund the state’s illicit priorities.
This strategy serves a dual purpose. While primarily a revenue stream, these workers sometimes insert malware into the systems of their employers to steal sensitive data, creating further security vulnerabilities for thousands of companies.
Laundering the Loot through Global Networks
Once stolen or earned, the funds must be laundered to avoid detection and sanctions. In March 2026, the U.S. Treasury sanctioned six individuals and two companies for helping North Korea convert roughly $800 million into cryptocurrency during 2024.
The laundering network operated across multiple countries, including Spain, Laos, and Vietnam. To obscure the trail of funds, the network utilized a complex array of tools, including:
- Cross-chain bridges and DeFi services.
- Crypto exchanges and digital wallets.
- Multiple blockchains, with links to 21 wallet addresses across Bitcoin, Ethereum, and Tron.
U.S. Government Enforcement and Disruptions
The U.S. Department of Justice (DOJ) and the Treasury Department have intensified efforts to freeze and seize these assets. On June 5, 2025, the DOJ filed a civil forfeiture complaint in the U.S. District Court for the District of Columbia to seize over $7.74 million.
These funds were tied to a scheme involving Sim Hyon Sop, a representative of the North Korean Foreign Trade Bank (FTB), who allegedly conspired with illegal IT workers to launder cryptocurrency. The DOJ has stated it will continue using every legal tool available to safeguard the cryptocurrency ecosystem and deny North Korea the ability to bankroll its weapons programs.
- Financial Impact: Annual thefts grew from $660.5 million in 2023 to $2 billion in 2025.
- Primary Tactics: Use of social engineering and malware (AppleJeus, TraderTraitor) to breach exchanges.
- Fraudulent Employment: IT workers use fake identities to secure remote jobs and funnel wages to the DPRK.
- Laundering Infrastructure: Heavy reliance on DeFi, cross-chain bridges, and networks spanning Vietnam, Laos, and Spain.
- Legal Response: U.S. Sanctions and civil forfeiture actions target both the hackers and the facilitators laundering the money.
The Future of Blockchain Security
The DPRK’s ability to exploit the cryptocurrency ecosystem poses a significant threat to the integrity and stability of the international financial system. As the regime continues to refine its social engineering and laundering techniques, the reliance on international cooperation between the U.S., South Korea, and Japan remains critical to disrupting these revenue streams and protecting the global digital economy.