South Korea Targets North Korean Hackers Funding Nuclear Theft Program

While routing out cyber criminals, South Korea has banned lists of 15 North Korean persons and one organization that allegedly conducts hikes to cryptocurrency and cyber theft for funding North Korea’s nuclear program.

These sanctions, announced by the Ministry of Foreign Affairs on December 26, have been aimed at the operatives allegedly involved in international operations to get foreign currency for the North Korean Munitions Industry Department and the programs of nuclear missiles.

Other North Korean hackers, including Lazarus Group, are also alleged to have been involved in some of the largest cyber thefts in the Web3 space. Current governments are ramping up efforts to combat these hackers, who are involved in over 50 percent of the global virtual currencies targeted for theft by 2024.

Key Figures Sanctioned For Funding North Korea’s Nuclear Program

Among the sanctioned people, Kim Cheol-min, the so-called 313th General Bureau, was accused of laundering money for several firms in the USA and Canada and then transferring enormous sums of foreign money to finance the Nuclear program of North Korea.

Another person is Kim Ryu Song, another North Korean whose clearance to conduct business in the country is being charged as engaging in sanction busting, money laundering, and relative identity theft. According to South Korean media sources, on December 11, lawmakers in the United States brought an indictment of Kim stating that the leader embezzled 88 million dollars for six years through fraud.

The sanctions come after a record year in cybercrime.” In 2024, cybercriminals succeeded in stealing $2.3 billion in cryptocurrencies, an increase of forty percent compared to 2023. Of that $1.34 billion, North Korean hackers were accused in a study conducted by Chainalysis. From this figure, you can infer that approximately 61.69% of the total cryptocurrency stolen globally was stolen through such attacks, which shows that such attacks have become more sophisticated.

It was claimed that North Korean hackers conducted 47 cyberattacks in 2024, with a 102% higher stolen value than those in 2023, with $660 million stolen. Nevertheless, the average cost of all these attacks concerning payouts has been estimated to be less than $50 m. On the other hand, the danger has been realized at the cumulative level, which further underscores the scale and nature of these cyber operations.

Officials are worried that the frequency and severity of cybercrimes involving Pyongyang’s hackers are increasing. Lazarus Group, one of the world’s most infamous cybercriminal groups, is linked with some of the largest crypto-jacking, including the $600m Ronin Network. These cybercriminals work with strategies that involve what are deemed fake identities within an organization, resulting in the theft of cash to finance the nuclear program back in Pyongyang.

Chainalysis recently reported that the behaviors of North Korean-related cybercriminals are being quickly updated. They now target decentralized finance (DeFi) projects and infrastructure Web3 applications. This change implies that the threat to the global crypto market moves to the next level.

The latest South Korean sanction is just one of many actions to mimic North Korea’s cyber activities. This will also try to cut off the finance it provides for nuclear-related activities in North Korea and send a strong message on cyber thefts.

“Notably, attacks between $50 and $100 million, and those above $100 million occurred far more frequently in 2024 than they did in 2023, suggesting that the DPRK is getting better and faster at massive exploits.”

Cryptocurrency businesses are still dealing with one Achilles heel after another as governments and cybersecurity companies slowly shut them down. However, by 2025, far more complex threats can unfold, and that’s the reason why governments and industries worldwide should join their efforts.