An image of a digital safe and a Bitcoin symbol layered with the shadow of a weapon. This symbolizes the reality of North Korea's cyber operations, where cryptocurrency theft via hacking leads directly to weapons development and money laundering. Composite by Han-Mi-Il Bo.

The 8.9GB of internal Kimsuky documents unveiled at DEF CON 33 in Las Vegas in August 2025 revealed more than just a simple hacking incident; it laid bare the funding structure for the North Korean regime's war machine.

The materials analyzed in this installment—specifically the ‘Finance_Logs’, ‘CryptoWallets’, and ‘Weapon_Proj_Link’ folders—demonstrate how North Korea funneled funds acquired through cyberattacks into its weapons programs.

Cryptocurrency Wallet Access Records

The data contained various cryptocurrency wallet addresses and access logs for Bitcoin, Ethereum, and Monero. Some entries showed traces of accounts being seized from exchanges in South Korea and Japan, followed by transfers to these wallets, which were then routed through VPNs to exchanges based in Russia and China.

Excerpt from the original source (from CryptoWallets.log)

wallet_id=0x9f7d3e4... 

tx_hash=ab56cd... 

timestamp=2024-02-17 21:44 

target_exch=HKEx (Hong Kong) 

amount=3,250 ETH

The excerpt translates to: "On February 17, 2024, 3,250 Ethereum was transferred from a specific seized wallet to a Hong Kong exchange." This confirms that large amounts of cryptocurrency were moved rapidly through international exchanges.

Money Laundering Routes

The documents also included automated scripts for money laundering.

Excerpt from the original source (from wash_flow.py)

split into 128 tx 

via exch=SG,HN 

merge -> DPRK_ctrl_wallet

Translated, this means: "Split into 128 micro-transactions, routed through Singapore and Hanoi exchanges, and then merged back into a DPRK-controlled wallet." This reveals a sophisticated money laundering structure designed to evade international sanctions.

Evidence of Links to Weapons Programs

Even more shocking is the connection to weapons development programs.

Excerpt from the original source (from Weapon_Proj_Link.doc)

fund allocation: 

- Crypto -> Lab112 

- Crypto -> Missile Parts Procurement

This indicates: "Cryptocurrency revenue allocation: Reserved for Lab 112 and missile parts procurement." In other words, the profits earned through hacking were directly funneled into missile research and the acquisition of weapons.

Evading International Sanctions

North Korea has long struggled to secure foreign currency due to international sanctions. However, hacking and cryptocurrency laundering have provided a new lifeline, bypassing these sanctions. Reports from the UN Security Council have already warned that "North Korea is evading sanctions by stealing hundreds of millions of dollars in cryptocurrency annually." The data released at DEF CON validates those warnings with actual code and log files.

Cyberattacks are not mere technical crimes. North Korea treats them as a core pillar of its war financing, operating a structure where profits from cryptocurrency hacking are directly linked to missile development and weapons procurement.

These materials demonstrate a threat that goes beyond the infiltration of democratic systems, directly endangering international security and peace. This structure cannot be dismantled without coordinated responses from allies, including South Korea, the United States, and Japan.

Coming Up Next

In Part 5, we will explore the theme "Response and Outlook: Concealment or Reform?" covering the responses from the South Korean government and the National Election Commission, the necessity for compulsory investigations by the National Intelligence Service, prosecutors, and police, and what lessons can be learned by comparing these events with international cases.

#Kimsuky #NorthKoreaHacking #CryptoLaundering #WarFunds #CyberSecurity #WeaponsDevelopment #InternationalSanctions #DEFCON33 #APTDown