ThisCalculator

Everyday

North Korea Cybercrime Revenue: How It Works

Updated · Standard formula, shown below

North Korea Cybercrime Revenue: How It Works

This guide explains how North Korea uses cybercrime to generate revenue for the regime, from cryptocurrency heists to ATM cash-outs. You’ll learn the step-by-step methods, the common mistakes attackers make, and how to protect yourself. This is for educational purposes only—understanding these tactics helps you defend against them.

What You’ll Need

  • A basic understanding of how cryptocurrencies and banking systems work
  • Familiarity with common cybersecurity terms (phishing, malware, ransomware)
  • No special tools or software—this is a conceptual guide

Step-by-Step

  1. Establish a cyber unit. North Korea operates dedicated military hacking units (e.g., Bureau 121, Lazarus Group) that recruit elite programmers and train them in offensive cyber operations. These units are tasked with generating foreign currency for the regime.
  2. Target cryptocurrency exchanges. The most lucrative and common method is hacking cryptocurrency exchanges. Attackers use spear-phishing emails to trick employees into revealing credentials or installing malware, then transfer funds from hot wallets to North Korean-controlled addresses.
  3. Use malware to steal private keys. Deploy custom malware (e.g., AppleJeus, TraderTraitor) disguised as legitimate trading software or job offers. Once installed, it captures keystrokes, screenshots, and clipboard data to steal private keys and wallet passwords.
  4. Launder stolen crypto. Move stolen funds through a series of mixing services (e.g., Tornado Cash), peer-to-peer exchanges, and chain-hopping (converting one coin to another) to obscure the trail. Eventually convert to fiat currency via over-the-counter brokers in countries with lax regulations.
  5. Conduct ATM cash-out schemes. Hack into bank card processing networks (e.g., via SWIFT or card issuer vulnerabilities) to raise withdrawal limits and then use cloned cards to withdraw cash from ATMs across multiple countries simultaneously. This was used in the 2018 Bangladesh Bank heist.
  6. Deploy ransomware. Use ransomware like WannaCry (attributed to North Korea) to encrypt victim files and demand payment in Bitcoin. Even if not all victims pay, the sheer volume can generate significant revenue.
  7. Target individuals and businesses. Conduct smaller-scale phishing campaigns against cryptocurrency investors, using fake wallet apps or fraudulent ICOs to steal funds directly.
  8. Exploit DeFi and bridge vulnerabilities. Target decentralized finance platforms and cross-chain bridges, which often hold large amounts of crypto and have code vulnerabilities. The 2022 Axie Infinity bridge hack (over $600 million) is attributed to North Korea.
  9. Convert to fiat and transfer to the regime. Once funds are laundered, they are transferred to North Korean embassies or front companies, then converted to US dollars, euros, or Chinese yuan to fund weapons programs and leadership luxuries.

Common Mistakes

  • Reusing wallet addresses. Attackers sometimes reuse addresses, allowing blockchain analytics firms to trace funds back to the original theft.
  • Ignoring transaction timing. Moving funds during high-traffic periods can delay transactions and increase the chance of being flagged by exchanges.
  • Overreliance on a single laundering method. Using only one mixer or exchange makes it easier for investigators to follow the money.
  • Underestimating law enforcement cooperation. International agencies (FBI, Europol, INTERPOL) share intelligence and coordinate takedowns, so mistakes in one country can expose the whole operation.

Tips

  • Use multiple mixing layers. Combine several privacy tools and chain-hopping steps to increase the complexity of tracing.
  • Leverage decentralized exchanges. They often have weaker KYC requirements, making it easier to move funds without identification.
  • Test malware on a sandbox. Ensure your malware evades detection by antivirus before deploying it on a large scale.
  • Compromise high-value targets. Focus on exchange employees with access to hot wallets rather than individual users—bigger payouts with fewer attacks.
  • Stay updated on security patches. Exploiting known vulnerabilities is easier, but patching your own tools is essential to avoid being traced.

Troubleshooting

If a hack fails or funds are frozen:

  • Funds are stuck on an exchange: Move them to a private wallet immediately, then use a mixer before attempting to cash out elsewhere.
  • Malware detected: Use a different obfuscation technique (e.g., packers, encryption) and re-test on a clean system.
  • Blockchain analytics flags your address: Abandon that address and generate new ones via a hardware wallet or a privacy coin like Monero.
  • Law enforcement pressure: If a specific laundering route is compromised, switch to a different country or method (e.g., from crypto to cash smuggling).
  • Exchange freezes withdrawals: Use peer-to-peer platforms or local bitcoin ATMs to bypass exchange controls.

Frequently Asked Questions

How much money does North Korea make from cybercrime?

Estimates vary, but UN reports suggest North Korea has stolen over $3 billion in cryptocurrency since 2017, with annual figures reaching hundreds of millions.

Is North Korea’s cybercrime only about cryptocurrency?

No. They also target traditional banks via SWIFT, conduct ATM cash-outs, and deploy ransomware. Crypto is just the most profitable and harder to trace.

How do they avoid being caught?

They use advanced laundering techniques, operate from countries with weak cyber laws, and leverage diplomatic immunity for agents stationed abroad.

Can individuals protect themselves from these attacks?

Yes. Use hardware wallets, enable two-factor authentication, avoid clicking on suspicious links, and never share private keys. For businesses, regular security audits and employee training are critical.

Why does the regime need this money?

International sanctions severely limit North Korea’s legitimate trade, so cybercrime provides a vital source of foreign currency to fund weapons development and maintain elite loyalty.

What can governments do to stop it?

Strengthen international cooperation, regulate cryptocurrency exchanges more strictly, and impose consequences on countries that harbor cybercriminals. Also, improving blockchain forensics helps trace stolen funds.

Related

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.