North Korean Cybercriminals Allegedly Stole Over $659 Million in Crypto Assets in 2024

North Korean cybercriminals have been accused of stealing $659 million in cryptocurrency across a string of heists in 2024.

At a Glance

North Korean hackers allegedly stole at least $659 million in crypto in 2024.
The Lazarus Group reportedly led these attacks using sophisticated malware.
Major thefts from exchanges like DMM Bitcoin and WazirX were reported.
U.S., South Korea, and Japan issued warnings about cybersecurity threats.

Massive Crypto Thefts by North Korea in 2024

North Korean hackers allegedly orchestrated audacious attacks, stealing $659 million in 2024 from multiple cryptocurrency exchanges and financial platforms. The U.S. Department of State revealed these details based on reports and investigations by cybersecurity firms. This surge represents a growing trend in cybercrime, showcasing North Korea’s advancements in digital manipulation and their unabashed targeting of international crypto assets.

The Lazarus Group, a notorious North Korean hacking entity, orchestrated at least five major heists using advanced social engineering techniques combined with ingenious malware deployment, according to the U.S. Prominent targets included the Japanese exchange DMM Bitcoin, which lost $308 million in May 2024, and WazirX, India’s largest crypto exchange, which suffered a $235 million loss in July. These incidents underscore the substantial threat posed by North Korean cyber activities.

US govt says North Korea stole over $659 million in crypto last year – @serghei https://t.co/EgayReUNVL https://t.co/EgayReUNVL

— BleepingComputer (@BleepinComputer) January 14, 2025

Sophisticated Attack Methods

North Korean hackers allegedly used social media platforms like LinkedIn to impersonate recruiters, thereby deceiving unsuspecting cryptocurrency exchange employees. Reports indicate this approach facilitated the installation of malicious software, resulting in significant crypto thefts. The employment of well-crafted digital traps emphasizes the need for increased vigilance within the tech and finance sectors.

The use of tools like TraderTraitor and AppleJeus by the Lazarus Group revealed a sophisticated level of planning and execution. This method of cyber infiltration showcased an alarming robustness that caught international law enforcement agencies’ attention. Additionally, North Korean ‘IT warriors’ allegedly managed to impersonate U.S.-based workers, further deepening concerns over internal security breaches within companies.

International Response and Prevention Measures

The U.S., South Korea, and Japan’s joint declaration underscored the need for all nations, particularly those involved in blockchain and freelancing sectors, to enhance verification measures and thwart potential North Korean infiltration. They called for an international coalition to strengthen cybersecurity protocols to counteract these growing digital offenses.

“The United States, Japan, and the Republic of Korea advise private sector entities, particularly in blockchain and freelance work industries, to thoroughly review these advisories and announcements to better inform cyber threat mitigation measures and mitigate the risk of inadvertently hiring DPRK IT workers,” the countries stated.

This joint effort aims to curb the extensive range of techniques used by North Korean hackers, which include phishing campaigns, digital impersonations, and the strategic deployment of malware under false pretenses. Private sector entities are encouraged to stay informed on cybersecurity advisories to effectively protect themselves from these pervasive threats.