North Korea Has Stolen Billions in Crypto, Used Fake Tech Jobs to Fund Weapons: Report
North Korea’s government-backed hackers have stolen billions of dollars in cryptocurrency and used fake tech worker identities to infiltrate international companies, funneling illicit earnings into the country’s nuclear weapons and missile programs, according to a new multilateral investigation. The 138-page report, compiled by an international sanctions monitoring team, accuses Pyongyang of using cybercrime as a key source of revenue to evade United Nations sanctions.
Massive Crypto Thefts and Cyber Attacks
The report details how North Korean hackers have repeatedly targeted cryptocurrency exchanges, fintech platforms, and international organizations to steal digital assets and sensitive data.
According to the findings, North Korea’s cyber units — operating under the supervision of state intelligence — have used malware, phishing, and ransomware attacks to breach global networks.
The team’s analysis found that billions of dollars were stolen from exchanges and investment platforms over the past decade, with cryptocurrency now serving as a primary channel for Pyongyang’s illegal financial operations. The funds, investigators say, are being diverted to research and development of nuclear arms and ballistic missile systems.
The Multilateral Sanctions Monitoring Team, formed in 2024 by the US and ten allied nations, was established to monitor North Korea’s compliance with UN restrictions after Russia vetoed the renewal of the UN Security Council’s panel of experts.
Fake Tech Jobs Used to Infiltrate Companies
Beyond hacking, North Korea has developed a vast network of fake tech workers who remotely infiltrate Western companies. Thousands of individuals — posing as developers, engineers, and IT specialists — have reportedly been employed by US and European firms using stolen or fabricated identities.
These workers gained access to corporate systems, siphoned proprietary information, and redirected their salaries back to the North Korean regime. In several cases, individuals were found holding multiple remote jobs simultaneously, earning hundreds of thousands of dollars annually for the government in Pyongyang.
US federal authorities have already identified and sanctioned several front companies and intermediaries involved in the scheme.
Laundering and Military Procurement
The North Korea crypto theft operations go far beyond hacking. The regime has used digital currencies to launder money and purchase restricted technologies, allowing it to bypass global trade restrictions and arms embargoes.
Investigators reported that North Korean entities have purchased components for missile guidance systems, encrypted communication devices, and other dual-use technologies using cryptocurrency wallets linked to hacked funds.
These activities, the report states, have “been directly linked to the destruction of computer systems, theft of private assets, and the continued funding of the DPRK’s unlawful weapons of mass destruction programs.”
Cyber Capabilities Rival Major Powers
Despite being economically isolated, North Korea’s cyber capabilities now rival those of China and Russia, making it one of the most dangerous digital adversaries on the global stage.
The country’s elite hacking units, including groups like Lazarus and APT38, operate under the Reconnaissance General Bureau, Pyongyang’s main intelligence agency.
The report warns that North Korea’s focus on cyber-enabled financial crime poses a major threat to global security and economic stability, as stolen crypto assets are funneled directly into military development.
International Coalition’s Findings
The monitoring group behind the report includes the United States, Australia, Canada, France, Germany, Italy, Japan, Netherlands, New Zealand, South Korea, and the United Kingdom.
Its first publication, released earlier this year, documented North Korea’s military support for Russia in its war against Ukraine.
The latest report marks the most comprehensive assessment yet of North Korea’s cyber-financing ecosystem, showing how Pyongyang has transformed digital crime into a state-controlled economic strategy.
Billion-Dollar Crypto Heists Linked to Pyongyang
Earlier this year, hackers linked to North Korea executed one of the largest cryptocurrency heists in history, stealing $1.5 billion worth of Ethereum from Bybit, a major trading platform.
The FBI traced the attack to a hacking cell working under the North Korean intelligence service, adding to a growing list of high-profile thefts attributed to Pyongyang-backed groups.
Officials said the proceeds from these operations are now among North Korea’s top revenue sources, funding weapons programs and state-run enterprises.
Global Response and Next Steps
Western nations are now pushing for stricter sanctions on crypto exchanges that fail to report suspicious transactions tied to North Korea. The US Treasury has already blacklisted several digital wallets associated with known hackers, while cybersecurity experts warn that the DPRK’s reliance on crypto-based financing is only increasing.
The report concludes that without coordinated international monitoring, North Korea’s crypto theft operations will continue to expand, providing the regime with the means to sidestep global economic restrictions indefinitely.
