A confidential report from the United Nations obtained by Reuters reveals that the Lazarus Group, a notorious cybercriminal organization based in North Korea, transferred millions of stolen cryptocurrency funds back to the country last year.

In March 2023, these North Korean hackers illegally seized $147.5 million worth of cryptocurrency from HTX, a crypto exchange owned by TRON founder Justin Sun. A year later, they channeled the funds into North Korea using the sanctioned cryptocurrency mixer Tornado Cash.

North Korea's Cyber Offensives

According to a report submitted last week, monitors informed a United Nations Security Council (UNSC) sanctions committee that they had been investigating 97 suspected North Korean cyberattacks on cryptocurrency firms between 2017 and 2024, amounting to approximately $3.6 billion.

The monitors also noted that North Korean IT workers abroad generate significant income for their country, as per information from U.N. member states and private companies. They were also examining a New York Times report from February 6, which alleged that Russia had released $9 million out of $30 million in frozen North Korean assets and had allowed Pyongyang to establish an account at a Russian bank in South Ossetia, facilitating improved access to international banking networks.

The Lazarus Group and other North Korean hackers have orchestrated some of the most profitable hacks in the crypto and decentralized finance (DeFi) sectors, with Tornado Cash being their preferred mixing service.

In 2022, the U.S. sanctioned Tornado Cash, accusing it of aiding North Korea. In 2023, two of its co-founders were charged with enabling over $1 billion in money laundering, including for a cybercrime group linked to North Korea.

North Korea's Varied Targets in $1 Billion Crypto Theft

An earlier UNSC report revealed that North Korea obtained 50% of its foreign exchange earnings from cyberattacks. The country intensified its focus on cryptocurrency platforms in 2023, targeting more entities than ever before.

However, the total amount stolen was lower compared to 2022, according to Chainalysis. Despite this decline, the number of hacks reached a record high of 20, coinciding with a general downturn in the crypto market.

In 2023, the blockchain analysis firm estimated that the total stolen cryptocurrency amounted to just over $1 billion. Notably, North Korean hackers concentrated on DeFi, stealing approximately $429 million. They also targeted centralized services, exchanges, and wallet providers, from which they stole $150 million, $330.9 million, and $127 million, respectively.