The United States, Japan and South Korea have issued a warning against North Korean threat actors, who are actively and aggressively targeting the cryptocurrency industry. In their joint advisory, the countries said that groups of threat actors affiliated with the Democratic People’s Republic of Korea (DPRK) continue to carry out numerous cybercrime campaigns to steal cryptocurrency. Those bad actors – including the Lazarus hacking group, believed to be in the US deploying cyber attacks worldwide since 2009 — target “exchanges, digital asset custodians and individual users.” And apparently, they stole $659 million in crypto assets in 2024 alone.

North Korean hackers use “well-disguised social engineering attacks” to infiltrate their targets’ systems, the countries said. They also warned that actors could gain access to systems owned by the private sector by posing as freelance IT workers. Back in 2022, the US issued guidelines how to identify potential workers from North Korea, such as how they usually log in from multiple IP addresses, transfer money to accounts based in the People’s Republic of China, ask for payments in crypto, there are conflicts in their background information and cannot be reached. sometimes during their business hours.

Once bad actors are in place, they often deploy malware, such as keyloggers and remote access tools, to steal login credentials and, ultimately, virtual currency that they can control and can be sold. As for where the stolen funds go: The UN issued a report in 2022, revealing its investigators’ discovery that North Korea was using money stolen by allied threat actors for missile programs. . “Our three governments are working together to prevent theft, including from private industry, in the DPRK and to recover stolen funds with the ultimate goal of denying the DPRK illegal income for unlawful purposes. weapons of mass destruction and ballistic missile programs,” the US, Japan and South Korea said.