North Korea Crypto Hacks

Introduction to North Korean Crypto Hacks

North Korean hackers have been involved in several high-profile cryptocurrency hacks, including the recent $6 billion Binance hack. According to the FBI, these hackers have been using various techniques to launder the stolen funds, including using crypto bridges and exchanges. The cryptocurrency market has grown significantly in recent years, with the total market capitalization exceeding $1 trillion. However, this growth has also attracted the attention of malicious actors, including North Korean hackers. The use of cryptocurrencies such as Bitcoin and Ethereum has made it easier for hackers to launder stolen funds, as these transactions are often pseudonymous and can be made across borders.

Laundering Stolen Funds

The Block reported that North Korean hackers laundered $242 million of Binance loot via Tron, with crypto bridges Relay, THORChain, Chainflip, and Symbiosis moving about $140 million of stolen funds off Tron. Relay handled the most at $48 million. This highlights the complexity of the laundering process and the use of various crypto platforms to move the stolen funds. Crypto bridges are platforms that enable the transfer of assets between different blockchain networks. In this case, the hackers used these bridges to move the stolen funds from Binance, which is built on the Binance Smart Chain, to Tron, which is a separate blockchain network. The use of crypto bridges and exchanges has made it challenging for authorities to track and recover the stolen funds.

US Sanctions Russians

The US Treasury has sanctioned 10 individuals and one entity for allegedly helping North Korean IT workers earn money through fraudulent employment at legitimate businesses and convert cryptocurrency into cash. According to CryptoPotato, Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas converted millions of dollars in crypto for front companies that placed North Korean IT workers at businesses under false identities. The workers' earnings ultimately helped fund the North Korean regime and its weapons programs. The sanctions are part of a broader effort by the US government to disrupt the financial networks used by North Korean hackers. The use of front companies and fraudulent employment has enabled North Korean IT workers to earn money, which is then used to fund the regime's activities.

Potential Targets

OneKey founder Yishi Wang warned that North Korean hackers could target BlackRock's $62 billion Bitcoin exchange-traded fund (ETF), according to CryptoSlate. The warning puts fresh attention on Coinbase, which serves as the primary Bitcoin custodian for BlackRock's iShares Bitcoin Trust (IBIT). Wang's concern stems from the techniques North Korean attackers have used in previous cryptocurrency thefts, particularly the February 2025 Bybit hack. In that hack, the attackers compromised a developer's computer and manipulated the transaction interface to deceive authorized signers into approving a malicious transfer. The potential targeting of large cryptocurrency funds, such as BlackRock's Bitcoin ETF, raises concerns about the security of institutional custody arrangements and the potential financial consequences for investors.

Why it matters

The recent hacks and laundering activities highlight the ongoing threat of North Korean hackers to the cryptocurrency market. The use of various crypto platforms and techniques to launder stolen funds makes it challenging for authorities to track and recover the funds. The potential targeting of large cryptocurrency funds, such as BlackRock's Bitcoin ETF, raises concerns about the security of institutional custody arrangements and the potential financial consequences for investors. As the cryptocurrency market continues to evolve, it is essential for investors to be aware of the risks and for authorities to take measures to prevent and mitigate these threats. This includes improving the security of crypto platforms, enhancing anti-money laundering (AML) and know-your-customer (KYC) regulations, and increasing international cooperation to disrupt the financial networks used by malicious actors.