A confidential report obtained by Reuters from the United Nations has shed light on the alarming activities of the Lazarus Group, a notorious cybercriminal organization based in North Korea. This report reveals that the Lazarus Group has been actively transferring millions of stolen cryptocurrency funds back to their home country, using the sanctioned cryptocurrency mixer Tornado Cash as a conduit.

In March 2023, these North Korean hackers illegally seized a staggering $147.5 million worth of cryptocurrency from HTX, a crypto exchange owned by TRON founder Justin Sun. A year later, they successfully channeled these ill-gotten gains into North Korea, further bolstering the country's illicit financial operations.

North Korea's Relentless Cyber Offensives
According to the report submitted to the United Nations Security Council (UNSC) sanctions committee, monitors have been investigating a staggering 97 suspected North Korean cyberattacks on cryptocurrency firms between 2017 and 2024, amounting to approximately $3.6 billion in stolen funds. This alarming trend underscores the country's unwavering commitment to leveraging its cyber capabilities to finance its operations and circumvent international sanctions.

The monitors also noted that North Korean IT workers abroad generate significant income for their country, as per information gathered from U.N. member states and private companies. Furthermore, they are examining a New York Times report from February 6, which alleges that Russia has released $9 million out of $30 million in frozen North Korean assets and has allowed Pyongyang to establish an account at a Russian bank in South Ossetia, potentially facilitating improved access to international banking networks.

The Lazarus Group and other North Korean hackers have orchestrated some of the most lucrative hacks in the crypto and decentralized finance (DeFi) sectors, with Tornado Cash being their preferred mixing service. In 2022, the U.S. sanctioned Tornado Cash, accusing it of aiding North Korea. A year later, two of its co-founders were charged with enabling over $1 billion in money laundering, including for a cybercrime group linked to North Korea.

North Korea's Varied Targets in $1 Billion Crypto Theft
An earlier UNSC report revealed that North Korea obtained 50% of its foreign exchange earnings from cyberattacks. The country has intensified its focus on cryptocurrency platforms in 2023, targeting more entities than ever before. While the total amount stolen was lower compared to 2022, according to Chainalysis, the number of hacks reached a record high of 20, coinciding with a general downturn in the crypto market.

In 2023, the blockchain analysis firm estimated that the total stolen cryptocurrency amounted to just over $1 billion. Notably, North Korean hackers concentrated their efforts on DeFi, stealing approximately $429 million. They also targeted centralized services, exchanges, and wallet providers, from which they stole $150 million, $330.9 million, and $127 million, respectively.

This comprehensive report from the United Nations highlights the relentless and multifaceted nature of North Korea's cyber offensive against the global cryptocurrency ecosystem. As the country continues to exploit vulnerabilities and leverage illicit financial channels, the international community must remain vigilant and take decisive action to curb these malicious activities and protect the integrity of the digital financial landscape.