North Korea’s cyber operations have become one of its most profitable sources of foreign currency, with hackers allegedly stealing billions of dollars through cryptocurrency heists and fraudulent employment schemes, according to a new international report.
The findings, compiled by the Multilateral Sanctions Monitoring Team — a coalition of 11 nations including the United States, Japan, and the United Kingdom — reveal how Pyongyang has turned cybercrime into a key financial lifeline for its weapons development programs despite stringent international sanctions.
North Korea’s Expanding Cyber Strategy
The 138-page report details how North Korea’s state-backed hackers have evolved from simple scams into sophisticated operations that rival those of China and Russia. These cyber campaigns are now central to Pyongyang’s strategy for funding nuclear research, ballistic missile production, and other military initiatives.
Investigators found that North Korea’s hacking groups routinely infiltrate cryptocurrency exchanges, launder digital assets, and even create false identities to secure remote employment with foreign tech companies. The illicit income, they say, is funneled back to state coffers to support the regime’s weapons programs.
The report describes these tactics as a direct violation of U.N. sanctions aimed at restricting Pyongyang’s access to international financing and materials related to its nuclear ambitions.
A Network of Deception and Theft
According to the monitoring team, North Korean operatives have built a global web of deception to evade detection. Thousands of IT workers allegedly pose as developers, engineers, or data specialists working remotely for Western companies. The workers, often using stolen or fabricated identities, are said to channel their salaries directly to North Korea’s government.
In some cases, the same individual managed multiple remote jobs simultaneously, multiplying their income streams while providing the regime access to private corporate systems.
U.S. federal authorities have warned that this scheme not only generates millions in hard currency for North Korea but also risks giving its agents access to sensitive commercial networks and data.
Cryptocurrency Thefts and Global Impact
One of the most notable incidents cited in the report involved the theft of approximately $1.5 billion worth of Ethereum from the Singapore-based crypto exchange Bybit earlier this year. The FBI later attributed the attack to hackers linked to North Korea’s intelligence agency.
Investigators also documented a pattern of similar heists targeting crypto platforms across Asia, Europe, and North America. Collectively, these operations are believed to have yielded billions of dollars in stolen digital assets since 2017.
The report noted that Pyongyang uses these funds not only for research and weapons production but also to purchase sanctioned goods and technologies through third-party brokers in China and Russia.
Aided by Strategic Allies
Although North Korea operates independently, the report said its cyber operations have occasionally benefited from the “indirect support” of allies in Russia and China. This includes assistance in evading international monitoring systems and laundering funds through complex cross-border networks.
The report described these joint activities as contributing to “the destruction of physical computer equipment, endangerment of human lives, loss of private assets, and financing of the DPRK’s unlawful weapons programs.”
Origins of the Monitoring Team
The Multilateral Sanctions Monitoring Team was formed last year after Russia vetoed a U.N. Security Council resolution to renew the mandate of a panel of experts overseeing North Korea’s sanctions compliance.
Comprising officials from the U.S., Australia, Canada, France, Germany, Italy, Japan, the Netherlands, New Zealand, South Korea, and the United Kingdom, the group was tasked with maintaining oversight of Pyongyang’s global activities outside the formal U.N. framework.
Its first report, issued in May, examined evidence of North Korean arms shipments and military support for Russia amid the ongoing war in Ukraine. The current report marks the team’s second major publication, focusing on the regime’s growing reliance on cybercrime as a means of sustaining its isolated economy.
Global Security Implications
Experts warn that North Korea’s expanding cyber network poses a significant challenge to international law enforcement and cybersecurity infrastructure.
Unlike China or Russia, whose cyber operations are often politically motivated, North Korea’s campaigns are primarily financial — designed to fund its government and weapons programs directly. This makes deterrence and sanctions enforcement far more complex, analysts say.
Cybersecurity specialists have urged stronger international cooperation, tighter regulation of cryptocurrency markets, and enhanced identity verification measures for remote workers. Without coordinated action, the report warns, North Korea’s cyber financing network will continue to undermine global financial stability and nonproliferation efforts.
Pyongyang Silent on Allegations
As of Wednesday, North Korea’s mission to the United Nations had not responded to requests for comment on the allegations.
The regime rarely acknowledges cyber operations, though analysts note that North Korean leader Kim Jong Un has previously called cyber capabilities a “powerful weapon” in modern warfare.
For now, the report underscores a growing reality: North Korea’s hackers have become as central to its military strategy as its nuclear engineers and missile technicians — and their reach extends far beyond its borders.
Source: AP News – North Korea has stolen billions in cryptocurrency and tech firm salaries, report says
