Sanctions watchdog links N. Korean hackers to $1.65 bil. in crypto theft this year alone

gettyimagesbank

North Korea has stolen an estimated $2.84 billion (3.9 trillion won) worth of cryptocurrency since early 2024, including $1.65 billion this year alone, according to a new report released Wednesday by a South Korea-led multinational sanctions monitoring team.

The report, which focuses on Pyongyang's illicit cyber activities, marks the second publication by the Multinational Sanctions Monitoring Team (MSMT) since its launch in October 2024. The team tracks North Korea's sanctions evasion activities and cyber threats.

According to the findings, North Korean hackers stole about $1.19 billion in digital assets throughout 2024, accounting for roughly one-third of the regime's total foreign currency income that year. They stole an additional $1.65 billion between January and September this year.

The reclusive regime uses the illicit income to fund its sanctioned weapons programs.

The hackers breached major exchanges including Bybit in the United Arab Emirates, DMM Bitcoin in Japan, WazirX in India and BingX and Phemex in Singapore.

The stolen cryptocurrency was laundered and cashed out via brokers in China, Russia, Hong Kong and Cambodia.

The report also found that an estimated 1,000 to 2,000 North Korean IT professionals are currently working in at least eight countries including China, Russia, Laos, Cambodia, Equatorial Guinea, Guinea, Nigeria and Tanzania. They are affiliated with sub-organizations of U.N.-sanctioned North Korean entities and are sending roughly half of their income back to the North.

It noted that North Korean cyber groups have adopted increasingly sophisticated tactics, including conducting fake job interviews targeting industry professionals and jobseekers. They are also using artificial intelligence tools such as ChatGPT and DeepSeek to refine their methods.

Diplomatic sources described the report as the first comprehensive assessment consolidating previously fragmented information on Pyongyang's illicit cyber operations.

The report notably highlights North Korea’s exploitation of Cambodian financial platforms — Huione Group and its subsidiary Huione Pay — to launder and monetize stolen cryptocurrency.

Earlier this month, U.S. financial authorities severed ties between the Cambodia-based conglomerate and the U.S. financial system, citing its role in laundering proceeds from virtual currency scams and cyber heists carried out by malicious actors.

People watch a TV news report on North Korea's missile launch at a train station in Seoul, Wednesday. Yonhap

"The release of this report is expected to draw greater international attention to North Korea’s ongoing violations of U.N. sanctions exposed through its crypto thefts and overseas IT operations, while underscoring the growing sophistication and risks of its cyber activities," Seoul's foreign ministry said in a statement.

Along with the report, MSMT member states issued a joint statement condemning the North's ongoing cybercrimes and calling for stronger international cooperation to block its access to global financial systems.

"We urge the DPRK to engage in meaningful diplomacy, and we call on all UN Member States to join global efforts to maintain international peace and security in the face of ongoing threats from the DPRK and those who facilitate its illicit activities in violation of relevant United Nations Security Council resolutions," the statement read. DPRK stands for the Democratic People's Republic of Korea, North Korea’s official name.

This is the second report published by the MSMT, following its May 2025 report on unlawful military cooperation between North Korea and Russia.

The MSMT consists of 11 countries — South Korea, the United States, Japan, France, the United Kingdom, Germany, Italy, the Netherlands, Canada, Australia and New Zealand.

The monitoring body serves as an alternative to the U.N. Panel of Experts on North Korea, which was disbanded in April 2024 after Russia vetoed the annual renewal of its mandate while China abstained.

Unlike its predecessor, the MSMT operates outside the U.N. framework and does not report directly to the U.N. Security Council.