North Korean hackers are being pursued by governments worldwide that blame them for more than half of the value of cryptocurrency stolen during 2024.
Hackers like the infamous Lazarus Group are prime suspects in some of the most notorious cyber thefts in Web3, including the $600 million Ronin network hack.
South Korea is the latest country to impose sanctions against 15 North Korean IT organization members and one related group.
The sanctioned agents have allegedly procured funds for North Korea’s nuclear missile development program and the DPRK’s Munitions Industry Department through “overseas foreign currency-earning activities,” according to a Dec. 26 news release by South Korea’s Ministry of Foreign Affairs.
The 313th General Bureau’s Kim Cheol-min is among the sanctioned individuals who allegedly earned a “large amount of foreign currency” by working undercover for United States and Canadian companies before delivering the funds to Pyongyang’s nuclear weapons program.
Another sanctioned worker, Kim Ryu Song, was indicted by US lawmakers on Dec. 11 for violating sanctions, money laundering and identity theft in generating more than $88 million of revenue over six years, according to South Korean media reports.
Total annual funds loss. Source: Cyvers
The sanctions came after another big year for crypto hackers, who stole $2.3 billion worth of crypto in 2024, a 40% increase over the value stolen in 2023.
Related: Turkey introduces stricter crypto AML regulations
North Korea hackers stole $1.3 billion worth of value in 2024: Chainalysis
North Korea-affiliated hackers have become a major threat to the security of the crypto space.
During 2024, North Korean hackers stole over $1.34 billion worth of digital assets across 47 incidents, marking a 102% increase from the $660 million stolen in 2023, according to Chainalysis data.
DPRK hacking activity. Source: Chainalysis
The $1.34 billion represents over 61% of the total crypto value stolen during 2024 and more than 20% of the total hacking incidents.
Related: Cyvers launches institutional crypto security tool for $4B vulnerability
And in a worrying sign for 2025, sophisticated attacks by North Korean agents are increasing despite an overall decrease in the total number of attacks, wrote Chainalysis:
“Notably, attacks between $50 and $100 million, and those above $100 million occurred far more frequently in 2024 than they did in 2023, suggesting that the DPRK is getting better and faster at massive exploits.”
The time between successful DPRK attacks. Source: Chainalysis
The increase in the frequency of attacks that yielded higher profits to the tune of $50-100 million suggests that the DPRK has improved its hacking methods, allowing it to conduct more lucrative exploits.
In contrast, DPRK’s exploits in 2022 often resulted in profits of less than $50 million.
Magazine: 13 Christmas gifts that Bitcoin and crypto degens will love