Report: North Korean cybercriminals have appropriated $2 billion in cryptocurrency since 2018.

7

North Korean hackers persist in posing a significant risk to the wider cryptocurrency landscape, having pilfered an estimated $2 billion in crypto over the last five years.

Blockchain intelligence company TRM Labs has published its latest comprehensive analysis of the obscure realm of cryptocurrency-related hacking, concentrating on the activities of North Korean cybercriminals. As per TRM Labs’ findings, North Korea has appropriated approximately $200 million in crypto during 2023, representing 20% of all funds stolen this year.

It is estimated that North Korean cyberattacks are ten times more extensive than those conducted by other malicious entities. Hackers from this nation have also targeted the decentralized finance () sector, exploiting cross-chain bridges that continue to facilitate a considerable volume of cryptocurrency transactions.

Related: North Korea stole more crypto in 2022 than any other year: UN report

Cross-chain breaches, such as the Axie Infinity Ronin Bridge incident, led to the theft of $650 million in crypto, with North Korean hackers collectively stealing around $800 million across three distinct attacks in 2022 alone.

The techniques employed to execute these cyberattacks differ, involving phishing and supply chain assaults that compromise private keys and seed phrases.

TRM Labs observes that North Korean hackers have become increasingly resourceful with on-chain laundering techniques. Previously, cryptocurrency exchanges were utilized to liquidate stolen cryptocurrency, but this has progressed into intricate “multi-stage money laundering processes.”

Hackers have adapted their strategies in response to stringent sanctions imposed by the Office of Foreign Assets Control, law enforcement actions, and enhanced blockchain tracing technologies. TRM Labs analyzed North Korea’s 2023 Atomic Wallet breach as a case study of the obfuscation techniques currently employed by hackers from the sanctioned nation.

Report: North Korean cybercriminals have appropriated $2 billion in cryptocurrency since 2018.0Data visualization of the Atomic Wallet hack executed by North Korean hackers in June 2023. Source: TRM Labs

The event took place in June 2023, when hackers targeted the noncustodial wallet service Atomic Wallet, absconding with $100 million in cryptocurrency from 4,100 addresses. TRM Labs hypothesizes that a phishing or supply chain attack likely facilitated the breach.

Hackers siphoned funds from user wallets across the Ethereum, Tron, Bitcoin, XRP, Dogecoin, Stellar, and Litecoin blockchains, redirecting the stolen assets to new wallets.

ERC-20 and TRC-20 tokens were exchanged for Ether () and Tron (TRX) via decentralized exchanges before being laundered through a combination of automated programs, mixers, and cross-chain swaps.

Collect this article as an NFT to preserve this moment in history and show your support for independent journalism in the crypto space.

Magazine: Should crypto projects ever negotiate with hackers? Probably