North Korean hackers have been on the radar of governments worldwide, which have accused them of being responsible for more than half of the value of cryptocurrency stolen in 2024. The infamous Lazarus Group is one such prime suspect in some of the most notorious cyber thefts in Web3, including the $600 million Ronin network hack.
South Korea Imposes Sanctions on North Korean IT Organization Members
The latest country to impose sanctions against North Korean hackers is South Korea. On December 26, South Korea’s Ministry of Foreign Affairs released a statement announcing that 15 members of North Korean IT organizations and one related group have been sanctioned for their alleged involvement in procuring funds for North Korea’s nuclear missile development program.
Sanctions Against North Korean Hackers
According to the South Korean government, the sanctioned individuals have allegedly earned "a large amount of foreign currency" by working undercover for United States and Canadian companies before delivering the funds to Pyongyang’s nuclear weapons program. One such individual is Kim Cheol-min, a member of the 313th General Bureau, who was accused of generating significant revenue through his clandestine activities.
Kim Ryu Song Indicted by US Lawmakers
Another sanctioned worker, Kim Ryu Song, was indicted by US lawmakers on December 11 for violating sanctions, money laundering, and identity theft. According to South Korean media reports, Kim Ryu Song generated over $88 million in revenue over six years through his illicit activities.
Total Annual Funds Loss
The recent sanctions come as the global crypto community grapples with the aftermath of a big year for crypto hackers. In 2024, hackers stole a staggering $2.3 billion worth of cryptocurrency, marking a 40% increase from the value stolen in 2023.
North Korea Hackers’ Reign of Terror
North Korea-affiliated hackers have become a major threat to the security of the crypto space. According to Chainalysis data, North Korean hackers stole over $1.34 billion worth of digital assets across 47 incidents in 2024, marking a 102% increase from the $660 million stolen in 2023.
DPRK Hacking Activity
The $1.34 billion represents over 61% of the total crypto value stolen during 2024 and more than 20% of the total hacking incidents. The frequency of successful attacks by North Korean agents is increasing, despite an overall decrease in the total number of attacks.
Sophistication of DPRK Attacks
Notably, sophisticated attacks by North Korean agents are increasing, as Chainalysis wrote: "Attacks between $50 and $100 million, and those above $100 million occurred far more frequently in 2024 than they did in 2023, suggesting that the DPRK is getting better and faster at massive exploits." This suggests that the DPRK has improved its hacking methods, allowing it to conduct more lucrative exploits.
Timeline of Successful DPRK Attacks
The time between successful DPRK attacks is also decreasing. Chainalysis data shows that in 2022, DPRK’s exploits often resulted in profits of less than $50 million. However, the increase in frequency of attacks that yielded higher profits to the tune of $50-100 million suggests that the DPRK has improved its hacking methods.
Consequences for Crypto Industry
The rise of North Korean hackers poses a significant threat to the security of the crypto space. As governments worldwide crack down on these groups, it is essential for the crypto industry to take proactive measures to prevent such attacks from happening in the future.
Recommendations for Crypto Industry
- Implement robust security measures: The crypto industry must prioritize security and implement robust measures to prevent hacking attempts.
- Collaborate with governments: Collaboration between the crypto industry and governments is crucial in identifying and preventing cyber threats.
- Stay vigilant: As the landscape of cryptocurrency continues to evolve, it is essential for the crypto community to remain vigilant and proactive in addressing emerging threats.
Conclusion
The recent sanctions against North Korean hackers are a significant step forward in combating cyber threats. However, as the frequency and sophistication of DPRK attacks increase, it is crucial for the global crypto community to stay vigilant and proactive in preventing such attacks from happening in the future.