The United States, Japan and South Korea have issued a warning against North Korea malicious actors, who actively and aggressively target the cryptocurrency industry. In their joint advisory, the countries said that threat actor groups affiliated with the Democratic People’s Republic of Korea (DPRK) continue to carry out numerous cybercrime campaigns to steal cryptocurrencies. These bad actors — including the Lazarus hacking group, which the United States says have been deploying cyberattacks around the world since 2009 — target “exchanges, digital asset custodians, and individual users.” And apparently, they stole $659 million worth of crypto assets in 2024 alone.
North Korean hackers are using “well-disguised social engineering attacks” to infiltrate their targets’ systems, the countries said. They also warned that actors could gain access to privately owned systems by posing as independent IT professionals. In 2022, the United States issued guidelines on how to identify potential workers from North Korea, e.g. how they typically log in from multiple IP addresses, transfer money to accounts based in the People’s Republic of China, request encrypted payments , present inconsistencies with their general information and are unreachable. sometimes during their supposed working hours.
Once bad actors are present, they typically deploy malware, such as keyloggers and remote access tools, to be able to steal login credentials and, ultimately, the virtual currency that they are using. they can control and sell. As for where the stolen funds are going: The UN released a report in 2022 revealing its investigators’ finding that North Korea is using money stolen by affiliated threat actors for its missile programs. “Our three governments are working together to prevent theft, including in the private sector, by the DPRK and recover stolen funds with the ultimate goal of depriving the DPRK of illicit revenues for its illegal weapons of destruction programs and ballistic missiles,” the United States and Japan said. and South Korea said.
