The South Korean government has taken a bold move to curb North Korea’s escalating crypto hackers activities. Earlier today, the authorities announced sanctions against 15 individuals and one entity from the Democratic People’s Republic of Korea (DPRK).
These targets have been linked to illicit cyber activities, including crypto thefts that finance Pyongyang’s regime and military ambitions. The announcement sheds light on the intricate web of North Korea’s state-backed cyber operations and their global reach.
Bureau 313: The Engine of North Korea’s Crypto Hackers
Bureau 313, an organization under the Workers’ Party of Korea’s Machine-Building Industry Department, is at the heart of the sanctions. This department, under UN sanctions since 2016, plays a critical role in North Korea’s weapons production, including its ballistic missile program.
The individuals sanctioned have been operating under Bureau 313. Reportedly, they use their expertise to execute sophisticated cyber heists and funnel resources to support the regime’s goals.
Global Footprints of North Korean Cyber Operatives
North Korean IT personnel have been infiltrating companies worldwide under false identities. According to South Korea’s Ministry of Foreign Affairs, these operatives operate in regions such as China, Russia, Southeast Asia, and Africa.
While posing as legitimate employees, they secure contracts, steal sensitive information, and execute cyberattacks. One sanctioned individual, Kim Cheol-min, reportedly infiltrated IT firms in the U.S. and Canada and funneled substantial sums of foreign currency to Pyongyang.
The sanctions highlight the DPRK’s reliance on crypto thefts as a critical revenue source. North Korean hackers have been implicated in some of the largest crypto heists globally, including Japan-based DMM Bitcoin’s $308 million theft.
The Federal Bureau of Investigation confirmed North Korean involvement in this attack, which forced the company to shut down. Recently, HyperLiquid, a popular Layer 1 blockchain, saw a massive $60 million USDC outflow that sparked concern within the crypto community.
Experts alleged that North Korean hackers might be sampling the decentralized exchange for exploits.
A Broader Crackdown on DPRK’s Cyber Networks
South Korea’s actions follow a series of sanctions from the U.S. Treasury Department. Not long ago, the department targeted two individuals and one entity for laundering digital assets for North Korea through a front company in the UAE.
These measures aim to disrupt the DPRK’s cyber operations, which have become increasingly sophisticated and lucrative. According to Chainalysis, a blockchain analytics firm, North Korean hackers stole $1.34 billion of digital assets across 47 incidents.
This staggering figure represents 61% of the total stolen globally last year, indicating a sharp rise in the scale and frequency of attacks.
