North Korean cyberwarfare attacks on the cryptocurrency industry grow within the sophistication and within the variety of groups involved in such criminal activities, the Crypto company Paradigma warns in report entitled “Demystification of the North Korean threat”.
Cyber attacks from North Korea range from attacks on stock exchanges and social engineering attempts to phishing attacks and sophisticated kidnapping of the availability chain, the report says. In some cases, the attacks last a 12 months for the North Korean employees to spend their time.
https://www.youtube.com/watch?v=NDV0RFEHETQ
The United Nations estimates that North Korean hackers have lodged 3 billion US dollars between 2017 and 2023. The entire route was deployed in 2024 and this 12 months with successful attacks against the Krypto exchange Wazirx and Bybit, which together achieved attackers around 1.7 billion dollars.
Paradigma writes that the North Korean organizations organize these attacks for a minimum of five years: Lazarus Group, Spinout, Applejeus, dangerous password and mabitor trader. There can also be a coalition of North Korean employees who present themselves as IT employees and infiltrate Tech firms all over the world.
Top -class attacks and predictable laundry methods
The Lazarus Group, essentially the most famous North Korean hacking team, has been recognized among the best-known cyber attacks since 2016. According to Paradigma, the Sony and Bank of Bangladesh chopped in 2016 and orchestrates the Wannacry 2.0 Ransomware attack in 2017 in 2017.
It has also adjusted to the cryptocurrency industry, sometimes an excessive amount of. In 2017, the group met two crypto exchanges – YouUBit and Bithumb. In 2022, the Lazarus group used the Ronin Bridge, which led to tons of of thousands and thousands of lost assets. And in 2025 it stole 1.5 billion US dollars from Bybit infaming and sent a shock in the whole crypto community. The group can stand behind some Solana Memecoin fraudsters.
As the chainalysis and other organizations have explained, the Lazarus Group also has predictable money laundering methods after securing a route. It disassembles the stolen amount into ever smaller pieces and sends them to countless other wallets. It then exchanges the illiquid coins for those with higher liquidity and converts quite a bit into Bitcoin (BTC). After that, the group can sit on the stolen money for a protracted time period until the eye of the law enforcement authorities dies.
So far, the FBI has identified three suspected members of the Lazarus group and accused them of cybercrime. In February 2021, the US Ministry of Justice charged two of those members for participation in global cybercrime.
