North Korean IT personnel (PG). Yonhap News

This year, at least $2.7 billion (approximately 3.99 trillion won) has been stolen globally through cryptocurrency hacks, with a majority attributed to North Korea, according to an analysis.

Notably, North Korea is focusing on centralized exchanges, which allow for the theft of large sums in a single attack, and is laundering the stolen funds on a large scale through China's underground financial network.

Blockchain research firm 'TRM Labs' released a report on the 18th stating that North Korea has weaponized cryptocurrency hacking at a state level for years to fund its weapons development and foreign currency earnings.

According to the report, North Korea's attack targets have completely shifted from small-scale decentralized finance (DeFi) services to large centralized exchanges (CEX). A prime example is the hacking of cryptocurrency exchange Bybit in February. It is estimated that North Korea stole approximately $1.5 billion (about 2.21 trillion won) from this single incident.

The attack methods have become more sophisticated. They have been employing tactics such as offering fake job opportunities or investments to developers of companies they target, sending them malicious code-infected files to infiltrate systems. TRM Labs analyzed that this 'Code to Custody' strategy has made the developer environment the most efficient path to access exchange assets.

Cryptocurrency (PG). Yonhap News

North Korea's methods for handling stolen funds have also evolved. In the past, they relied on mixing services to break down and obscure funds, but with sanctions from the United States blocking this, they have begun using underground financial networks referred to as the 'Chinese Laundromat'.

Stolen cryptocurrencies are split and moved across various blockchain networks, then handed over to money laundering networks composed of Chinese underground bankers, over-the-counter brokers (OTC), and money couriers to be cashed out. Through this process, hacking funds sometimes re-enter North Korean companies under the guise of payments for goods. TRM Labs assessed that the reason North Korea's large-scale money laundering operations continue despite Western sanctions is due to China's industrialized money laundering network.

Chris Wong, an investigator at TRM Labs and former FBI agent, stated, "North Korea's hacking is a highly specialized operation with strategic objectives," adding, "It requires real-time intelligence gathering, innovative networks, and cross-border cooperation."