North Korean cyberwarfare assaults on the cryptocurrency business are rising in sophistication and within the variety of teams concerned in such felony exercise, crypto agency Paradigm warns in report titled “Demystifying the North Korean Menace.”
North Korea-originated cyberattacks vary from assaults on exchanges and social engineering makes an attempt to phishing assaults and sophisticated provide chain hijacks, the report says. In some instances, the assaults take a yr to play out, with North Korean operatives biding their time.
The United Nations estimates that between 2017 and 2023, North Korean hackers have netted the nation $3 billion. The entire haul has skyrocketed in 2024 and this yr, with profitable assaults towards crypto exchanges WazirX and Bybit, which collectively netted attackers round $1.7 billion.
Paradigm writes that the North Korean organizations orchestrating these assaults quantity at the very least 5: Lazarus Group, Spinout, AppleJeus, Harmful Password, and TraitorTrader. There may be additionally a coalition of North Korean operatives who pose as IT staff, infiltrating tech corporations around the globe.
Associated: Typosquatting in crypto, defined: How hackers exploit small errors
Excessive-profile assaults and predictable laundering strategies
Lazarus Group, probably the most well-known North Korean hacking group, is given credit score for among the most high-profile cyberattacks since 2016. In keeping with Paradigm, the group hacked Sony and the Financial institution of Bangladesh in 2016 and helped orchestrate the WannaCry 2.0 ransomware assault in 2017.
It has additionally taken intention on the cryptocurrency business, typically to nice impact. In 2017, the group hit two crypto exchanges — Youbit and Bithumb. In 2022, Lazarus Group exploited the Ronin Bridge, leading to tons of of hundreds of thousands in misplaced belongings. And in 2025, it infamously stole $1.5 billion from Bybit, sending shock all through the crypto group. The group could also be behind some Solana memecoin scams.
As Chainalysis and different organizations have defined, Lazarus Group additionally has predictable cash laundering strategies after securing a haul. It breaks up the stolen quantity into smaller and smaller items, sending them to numerous different wallets. It then swaps the extra illiquid cash for these with greater liquidity and converts a lot of it to Bitcoin (BTC). After that, the group might sit on the stolen cash for an extended time period till the eye from regulation enforcement dies down.
The FBI has to this point recognized three alleged members of the Lazarus Group, accusing them of cybercrimes. In February 2021, the US Justice Division indicted two of these members for involvement in international cybercrimes.
Journal: Lazarus Group’s favourite exploit revealed — Crypto hacks evaluation
