US, Japan, and South Korea Sound Alarm on North Korean Crypto Thefts

The US, Japan, and South Korea released a joint statement today warning against North Korean cryptocurrency hackers. These nations urged deeper collaborations among their public and private sectors to disrupt cybersecurity threats.

North Korean hackers stole at least $1.3 billion of digital assets in 2024. The statement suggests the country aims to fund its ballistic missile programs with these illicit funds. 

A Call For Transnational Public-Private Collaboration

The US, Japan, and South Korea issued a joint statement condemning North Korea, emphasizing its significant threat to the integrity and stability of the international financial system and the broader global community.

“Our three governments strive together to prevent thefts, including from private industry, by the DPRK and to recover stolen funds with the ultimate goal of denying the DPRK illicit revenue for its unlawful weapons of mass destruction and ballistic missile programs,” the statement read.

According to the information provided, North Korean hackers target cryptocurrency exchanges, digital asset custodians, and individual users.

Investigations suggest that some North Korean cyberattacks have been carried out by North Korean IT workers who have infiltrated crypto and Web3 companies, compromising their networks and operations.

“The United States, Japan, and the Republic of Korea advise private sector entities, particularly in blockchain and freelance work industries, to thoroughly review these advisories and announcements to better inform cyber threat mitigation measures and mitigate the risk of inadvertently hiring DPRK IT workers.”

The announcement also highlighted the need for enhanced collaboration between public and private sectors across the three nations to counter these cybercrime operations proactively.

North Korean Hackers Stole Record Amounts in 2024

Hackers linked to North Korea have gained notoriety for their sophisticated and continuous cyberattacks. These attacks often involve the use of advanced malware, social engineering techniques, and cryptocurrency theft to fund state-sponsored operations and circumvent international sanctions.

According to research by Chainalysis, in 2023, North Korea-affiliated hackers stole approximately $660.50 million across 20 incidents. This number rose to $1.34 billion stolen across 47 incidents in 2024, representing an over 102% increase. 

US and international officials have assessed that North Korea uses the funds from cryptocurrency theft to finance its weapons of mass destruction and ballistic missile programs. These activities pose a significant threat to international security.

Three weeks ago, South Korea sanctioned 15 North Korean IT organization members for allegedly generating funds for its domestic nuclear weapons development program.

“In particular, North Korean IT personnel are known to be dispatched to China, Russia, Southeast Asia, Africa, and other countries as employees of regime-affiliated organizations such as the Ministry of Defense, disguising their identities and receiving work from IT companies around the world, while some are also known to be involved in information theft and cyberattacks,” read the statement released by South Korea’s Ministry of Foreign Affairs.

Hackers also use illicit funds to develop military-related software.

Most notably, North Korea’s Lazarus Group, an infamous hacker collective, has carried out some of the largest cyber thefts in the Web3 sector. 

“The advanced persistent threat groups affiliated with the DPRK, including the Lazarus Group, which was designated by the relevant authorities of our three countries, continue to demonstrate a pattern of malicious behavior in cyberspace,” reads the joint statement released by the US, Japan, and South Korea. 

Last October, the US government seized Bitcoin and Tether linked to the Lazarus Group after the organization stole $879 million. The US government also filed two legal actions to initiate the seizure of over $2.67 million in stolen digital assets.

According to filings, the seizure order addresses two major hacks. These include 1.7 million USDT stolen from the Deribit options exchange and over $970,000 worth of Bitcoin.