North Korea’s growing use of crypto-theft to finance nuclear weapons worries the US

North Korea is increasingly using its crypto-heists to finance its nuclear weapons program, US officials say.

“I am very concerned about North Korea’s cyber capabilities,” Anne Neuberger, the Biden administration’s deputy national security adviser for cyber and emerging technologies, said recently at an event hosted by the Center for a New American Security (CNAS). “They use cyber to achieve, we estimate, up to a third of [stolen crypto] funds to fund their missile program.”

“It’s a big problem, whether it’s attacks against cryptocurrency exchanges or the use of information technology workers in different countries,” Neuberger said.

She added that North Korea’s expansion of its missile tests is a top priority for the United States, which is taking several steps to counter Pyongyang’s cyber threats, including imposing sanctions on criminal groups and seizing stolen digital assets.

A UN report this year found that between 2020 and 2021, North Korean-backed hackers stole more than $50 million in digital assets to fund the country’s missile program, the BBC reported. The UN report also revealed that the attacks targeted at least three cryptocurrency exchanges in North America, Europe and Asia.

UN investigators said at the time that the attacks are an “important source of revenue” for North Korea’s nuclear and ballistic missile programs.

In 2019, the United Nations issued a similar report, this time saying that North Korea had raised about $2 billion to finance its weapons of mass destruction programs using sophisticated cyberattacks that targeted banks and cryptocurrency exchanges.

In April, the FBI said North Korean-sponsored hackers known as the Lazarus Group, which had previously been sanctioned by the Treasury Department for targeting critical infrastructure, were responsible for stealing about $620 million in cryptocurrency from the virtual game Axie Infinity.

North Korea began aggressively targeting the financial sector, especially digital currency, after the rise of bitcoin in the mid-2010s and the expansion of US and UN sanctions against Pyongyang, said Jason Bartlett, a research associate for the Energy, Economics and Security Program at CNAS.

“Right now, when we think about North Korea and cyber, there’s a big focus on the global financial services, mainly because North Korea needs money compared to other US cyber adversaries like Iran, China and Russia,” he said.

Bartlett added that North Korea likely also turned to crypto because it was not well regulated and understood at the time, making it easier for the East Asian country to exploit it for its own gains.

Although North Korea has shifted most of its focus on cyberattacks to the financial industry to generate revenue, it still uses hacks to target government institutions, particularly those in South Korea.

“There have been cases where they’ve also had politically motivated cyber attacks, but most of them are more financially based,” Bartlett said.

Jenny Jun, a political science Ph.D. student at Columbia University, said North Korea has used its cyber capabilities to conduct political and economic espionage, coerce and intimidate individuals it perceives as a threat to its government and to “the survival and continuation of the Kim family’s rule.”

“Even before [emergence] of cybercrime, North Korea maintained an extensive illegal network to generate foreign money, which was controlled by the Kim family to appease a small circle of elites, engage in repression and also pursue expensive weapons programs such as missile and nuclear programs, Jun said.

President Biden has faced criticism for not taking a more aggressive approach to North Korea after the test firing of several ballistic missiles earlier this year.

Biden, who has called for new diplomatic talks between the two nations, has so far failed to bring North Korea to the table.

Secretary of State Antony Blinken has said that North Korea’s latest missile tests were “deeply destabilizing” and that the administration is working closely with its allies, including South Korea and Japan, to respond.

Although there has been little diplomatic engagement, the Biden administration has actively countered North Korea in cyberspace, Neuberger said at the CNAS event.

Last month, the Department of Justice (DOJ) and the FBI announced the return of more than half a million dollars in ransom money after it disrupted ransomware operations of a North Korean state-backed group that targeted US medical facilities.

Deputy Attorney General Lisa Monaco said the stolen funds were laundered through cryptocurrency.

In 2020, the DOJ filed a motion to seize 280 cryptocurrency accounts for allegedly facilitating the laundering of millions of dollars during two North Korean hacking incidents.

“We’re doubling down and planning to do a lot more work to make it riskier, more expensive and more difficult for North Korea to get funds that way,” Neuberger said.