According to a report by a blockchain analytics firm driven by a surge in criminal cyber operations from 2018 to 2024, North Korean hackers stole $1.6 billion in cryptocurrency. 

In 2023, they stole a stunning $660.5 million, but that was a fluke. This shows the central role cybercrime plays in funding Pyongyang’s government activities, which now total $1.115 billion.

Crypto platforms globally lost $2.2 billion worth of cryptocurrency in 2024, of which 61 percent came from North Korea. This year, regime hackers carried out 47 attacks, double that of 2023. 

North Korean hackers stole more from crypto platforms than ever before: $1.34 billion, which represents 61% of the total amount stolen for the year. pic.twitter.com/tVBsOKW8U7

— Chainalysis (@chainalysis) December 19, 2024

Most of these cyber exploits were focused on decentralized finance (DeFi) platforms, which hackers claimed were funneling the stolen funds into North Korea’s weapons development and ballistic missile programs.

North Korea Leads In Global Cryptocurrency Theft 2024

There has been an adaptation in this: “Advanced and very sophisticated malware, social engineering schemes.” They sometimes infiltrated cryptocurrency companies, posing as remote IT workers.

But it prompted one high-profile case: 14 North Korean nationals were charged by the U.S. Department of Justice for working from home using false identities. Accordingly, these individuals made over $88 million through data theft and extortion schemes.

The attacks have become much more frequent and much more large in scale. In 2024, more large-scale hacks of more than $100 million occurred on North Korean groups than in other years. 

Meanwhile, smaller hacks involving less than $50 million have become more commonplace as hackers become more adept at conducting both large and comparatively small cybercrimes.

North Korea’s reliance on cybercrime to sidestep economic sanctions is now drawing mounting alarm in the international community. U.S. officials estimate that the regime gets up to one-third of the funding for its missile program from illicit online activities. The destabilization of the global cryptocurrency market is part of these activities, which also feed Pyongyang’s military ambitions.

Surprisingly, many of North Korea’s crypto thefts occurred during the first six months of 2024. The hacking activity dropped off after June, and around the same time, we began to see a culture of normalization between North Korea and Russia. 

This shift in North Korea’s cyber strategies may have been influenced by an analyst’s speculation that a meeting between North Korean leader Kim Jong Un and Russian President Vladimir Putin last spring signaled increased cooperation between the two nations.

“In particular, the report states that it may be possible that, in addition to reallocating its military resources toward Ukraine, the DPRK, which has dramatically increased its interactions with Russia in recent years, may have altered its cybercriminal activity as well” the report said.

While the mid-year slowdown is underway, North Korea remains a top player in cryptocurrency theft antics, contributing to two-thirds of all hacking events globally in 2024.

Although the regime or its supporters have denied any attribution, their sheer scale suggests a role in funding the same governmental and military priorities that the country puts so much effort and money into: cybercrime.

Due to North Korea’s cyber activities and the Daesag cyber war, the challenges for nations to secure global cybersecurity and global financial systems are becoming more urgent. This year, there has been an unprecedented amount of theft, and the threat landscape in the digital economy is ever-changing.