How Hackers from North Korea Are Sustaining the Regime

As the number of international sanctions against North Korea continues to grow and prevent the country’s access to global financial sources, Pyongyang’s army of hackers has continued to launch attacks on vulnerable crypto accounts across the globe.

According to a report released by Chainalysis, a blockchain analysis company based in the United States, hackers stole around $1.9 worth of crypto in the first seven months of this year. This figure was about 700 million more than what was stolen by hackers last year at the same time. The report said that from the evidence left behind, it is estimated that the bad actors affiliated with North Korea stole around $1 billion. Especially hacking units such as the Lazarus group.

It is said that the hacking units are stately sponsored by the North Korean government. They have numerous ways to get their hands on cryptocurrency accounts. Furthermore, these units primarily focus on decentralized finance platforms known as DeFi protocols which allow different users, irrespective of location, to share cryptocurrencies without using third-party systems or centralized firms.

Analysts have, however, warned that since the decentralized protocols are open source, they are studied for weakness and exploited by cybercriminals. Crypto experts and analysts unanimously agree that hacking occurs daily across the globe. Hackers recently spotted and exploited a weakness in the General Byte Bitcoin ATM servers. Using this weakness, the hackers stole crypto during transactions. Nomad, a start-up company, recently offered a bounty to anyone who would help the firm trace the $190 million worth of assets stolen in an attack in August.

Targeting South Korean users

In an interview, a South Korean crypto analyst said that crypto hacks were getting bigger yearly because the total value locked in the decentralized finance system has been increasing.

Another analyst who refused to be disclosed said that North Koreans had been successfully preying on South Korean users. He added that for this reason, Korean banks are stringent regarding security measures compared to Western banks.

Major concerns for South Korea occurred around 20 years ago when hackers carried out a DoS attack on various infrastructures across the country. These include hospitals, banks, and power plants, among others. However, things went off the board in 2019 when North Korea was linked to a power plant hack in India and the famous Wannacry ransomware that troubled the globe.

In an interview with Eat News, Mark Meyerson, a digital expert, said that international sanctions against North Korea will continue to grow as hackers have constantly been launching multiple attacks globally.

Meyerson said that the North Korean government has been targeting the world’s cryptocurrency exchanges and mining pools with a new wave of malicious software designed to steal users’ coins. He also warned that hackers are using phishing emails and malicious websites to lure unsuspecting users into installing malware on their machines that can be used to steal passwords or other sensitive information.

As the sanctions continue to tighten and Kim Jong Un refuses to change his mind on his nuclear plans, the regime is being kept afloat by money stolen from other people’s crypto accounts. In the 2016 Bangladesh Bank cyber heist, around $81 million were stolen. It might be possible that the growth of the unregulated crypto market has given the country a fresh opportunity.

According to Aditya Das, who is a New Zealand-based crypto analyst, there are two main methods deployed by hackers to exploit and hack crypto accounts. The first is exploiting DeFi vulnerabilities, a technique that the North Koreans have perfected. The second method used is known as spearfishing. In this method, the hacker contacts innocent users, build a good relationship with them and inquiries about their technology.

According to Das, these hackers will present their victims with a well-paying job and require evidence of the technology used by the system. Having accessed this information, they then send a file with malware to corrupt the technology. Das finishes by saying that since the crypto market is not regulated, most firms will favour revenue over security, thus making them the perfect prey.

The United States Penalties on Hackers

The United States treasury, in early May, sanctioned Blender. Io-a virtual currency mixer for taking part in a malicious money laundering scam by North Korea. The department pointed out that the Lazarus group was behind the heist carried out and was sponsored by the North Korean government. The department also said the North Korean Government was using that money to advance its program of procuring weapons of mass destruction and ballistic missile programs. However, the largest heist occurred in March this year when the Ronin network was robbed of around $620 million. The attack happened due to a combination of social engineering and human error which saw an infected email in the system. According to analysts, the crypto world should expect more of this attack as the hunger for funds by the North Korean government is not diminishing any time soon.