https://www.economist.com/asia/2023/02/22/north-korean-hackers-stole-a-record-17bn-of-crypto-last-year

 Skip to content

  * Menu
  * Weekly edition
  * The world in brief
  * Search

Log in

  * Featured

      + War in Ukraine
      + Recession watch
      + The World Ahead 2023
      + US politics
      + Climate change
      + Coronavirus
      + 1843 magazine
      + The world in brief
  * Sections

      + The world this week
      + Leaders
      + Letters
      + Briefing
      + United States
      + The Americas
      + Asia
      + China
      + Middle East & Africa
      + Europe
      + Britain
      + International
      + Business
      + Finance & economics
      + Science & technology
      + Culture
      + Graphic detail
      + Obituary
      + Special reports
      + Technology Quarterly
      + Essay
      + By Invitation
      + Schools brief
      + The Economist explains
      + The Economist reads
  * More

      + Newsletters
      + Podcasts
      + Films
      + Subscriber events
      + The Economist app
      + Online courses

  * My Economist
  * Saved stories
  * Log out

  * Saved stories
  * Account
  * Log out

Search
[                    ]
Asia | Crypto-heist

North Korean hackers stole a record $1.7bn of crypto last year

Investigators are getting better at cracking the hackers

FILE - In this photo provided by the North Korean government, North
Korean leader Kim Jong Un attends a military parade to mark the 75th
founding anniversary of the Korean People's Army on Kim Il Sung
Square in Pyongyang, North Korea Wednesday, Feb. 8, 2023. Independent
journalists were not given access to cover the event depicted in this
image distributed by the North Korean government. The content of this
image is as provided and cannot be independently verified. Korean
language watermark on image as provided by source reads: "KCNA" which
is the abbreviation for Korean Central News Agency. (Korean Central
News Agency/Korea News Service via AP, File)
Feb 22nd 2023 | SEOUL
Share

Few forms of celebration are as close to literally burning money as
fireworks and missile tests. And for North Korea, a great fan of
both, the more it burns the better. It launched more than 95 cruise
and ballistic missiles in 2022, a new record. And it loves above all
to splurge on the biggest, showiest rockets, like the
intercontinental ballistic missile it fired eastwards into the sea on
February 18th.

Listen to this story. Enjoy more audio and podcasts on iOS or Android
.

Your browser does not support the <audio> element.

Despite being unable to feed its people, North Korea has found
innovative ways to fund its missiles programme, including by forging
foreign currency, committing insurance fraud and making and selling
arms and narcotics. A more novel revenue stream is stolen
cryptocurrency. Last year its hackers pinched a record $1.7bn of the
stuff, according to a report published this month by Chainalysis, a
data firm based in New York.

Some of North Korea's hacking thefts were eye-wateringly big. Last
March it ripped off a cross-chain bridge, a method for moving
cryptocurrency from one coin's blockchain to another, associated with
the game Axie Infinity. At the time it was discovered, the stolen
currency was worth more than $600m, making it the second-biggest
crypto-theft ever.

But as with all heists, the robbery is just the first step. To
launder their loot North Korean hackers employ all sorts of tricks,
including splitting up the money, moving it between different
crypto-wallets, converting it into different coins and putting it
through mixers--large digital pools where crypto owners can deposit
funds to obscure their origins.

Some of the stolen crypto was put to direct use. In 2022 two South
Koreans, including an army captain, were arrested on suspicion of
selling secrets to the North in return for bitcoin. But North Korean
hackers mostly try to turn the loot into hard cash, either through a
broker or more commonly through a centralised exchange. The fiat
currency obtained is then used to purchase items through established
procurement channels, run through front companies and North Korea's
embassies abroad.

Most of the hacking-and-laundering operation is visible to expert
eyes, however. "This isn't happening in some shadowy corner of the
world," says David Carlisle of Elliptic, another blockchain-analysis
company. "It's happening in public on the blockchain." This helps
investigators trace funds and understand hacking methods--and they are
getting better at doing both.

America has blacklisted crypto-wallets associated with North Korean
hackers. In May it targeted Blender.io, a mixer used in the Axie
Infinity hack. In September American investigators recovered $30m of
cryptocurrency stolen in that hack. Given a drop in the value of
cryptocurrency after the heist, that represented about 10% of the
total. On February 16th Norwegian authorities seized another $5.8m.

But countries should adopt more stringent measures, argues Allison
Owen of the Royal United Services Institute, a London-based
think-tank. "Most hacks begin with relatively unsophisticated
phishing attacks. Better regulation of the industry and cyber-hygiene
could help prevent them."

The crypto industry is meanwhile getting better at policing itself.
On February 14th two centralised exchanges, Binance and Huobi, froze
$1.4m of cryptocurrency associated with a North Korean hack.

The hackers are also adapting and improving. "It is a bit of a game
of whack-a-mole," says Mr Carlisle. Even if North Korea's hackers
could actually lay their hands on only a fraction of the $1.7bn they
stole, it would all be worthwhile, notes Dennis Desmond, a former
American intelligence officer who now teaches at the University of
the Sunshine Coast in Australia. "It's all free cheese," he says.

Mr Desmond foresees a continuing "arms race" in theft and
counter-theft capability between the hackers and
crypto-crimefighters. If the crimefighters could only get the upper
hand, it might help to slow the actual arms race, illuminated by a
blaze of ballistic missiles, taking place on the Korean peninsula. #

This article appeared in the Asia section of the print edition under
the headline "Crypto-heist"

Asia February 25th 2023

  * The Philippines' proximity to Taiwan makes it central to Western
    strategy
  * India's solar power rollout is flagging
  * North Korean hackers stole a record $1.7bn of crypto last year
  * Keeping up with the Tokugawas

The future of UkraineThe future of Ukraine

From the February 25th 2023 edition

Discover stories from this section and more in the list of contents

Explore the edition
Share
Reuse this content

More from Asia

[yH5BAEAAAA][20230225_A]

Keeping up with the Tokugawas

The new shogun reflects on family history and Japan's looming social
change

[yH5BAEAAAA][20230225_A]

India's solar power rollout is flagging

Protectionism is choking the supply of solar panels

---------------------------------------------------------------------
[yH5BAEAAAA][20230225_A]

The Philippines' proximity to Taiwan makes it central to Western
strategy

America has secured access to nine military bases in its former Asian
colony

---------------------------------------------------------------------

  * Subscribe
  * Group subscriptions
  * Reuse our content
  * The Trust Project
  * Help and contact us

Keep updated

  *  
  *  
  *  
  *  
  *  
  *  

Published since September 1843 to take part in "a severe contest
between intelligence, which presses forward, and an unworthy, timid
ignorance obstructing our progress."

The Economist

  * About
  * Advertise
  * Press centre

The Economist Group

  * The Economist Group
  * Economist Intelligence
  * Economist Impact
  * Economist Events
  * Working Here
  * Economist Education Courses
  * Which MBA?
  * Executive Jobs
  * Executive Education Navigator

  * Terms of Use
  * Privacy
  * Cookie Policy
  * Manage Cookies
  * Accessibility
  * Modern Slavery Statement
  * Sitemap
  * California: Do Not Sell My Personal Information

Copyright (c) The Economist Newspaper Limited 2023. All rights
reserved.