North Korea launders $147.5 million in stolen cryptocurrency, UN experts reveal

North Korea funnelled $147.5 million through the cryptocurrency mixer platform Tornado Cash in March, according to a confidential report by United Nations sanctions monitors reviewed by Reuters.

This illicit activity follows a hack on the HTX cryptocurrency exchange late last year, marking a major case in a broader pattern of North Korean cyber thefts targeting digital currency platforms.

The UN monitors reported to the Security Council sanctions committee that they have been investigating 97 suspected North Korean cyberattacks on cryptocurrency firms from 2017 to 2024, with total stolen funds amounting to approximately $3.6 billion.

The $147.5 million laundered in March was linked directly to the HTX exchange breach, based on data from crypto analytics firm PeckShield and blockchain research firm Elliptic.

In 2024 alone, the monitors have scrutinised 11 cryptocurrency thefts valued at $54.7 million, noting that many of these attacks might have been inadvertently facilitated by small crypto-related companies hiring North Korean IT workers.

These workers, operating abroad, reportedly generate substantial income for the isolated nation, which continues to face severe international sanctions aimed at curbing its nuclear and missile programs.

North Korea, officially known as the Democratic People’s Republic of Korea (DPRK), has been under UN sanctions since 2006.

Despite these measures, the country has continued to find ways to finance its prohibited activities, including through cybercrime and the use of virtual currency mixers like Tornado Cash.

The US sanctioned Tornado Cash in 2022 for allegedly supporting North Korean money laundering activities.

In 2023, two of its co-founders were charged with facilitating over $1 billion in illicit transactions, including for a North Korean cybercrime group.

Virtual currency mixers like Tornado Cash function by blending cryptocurrencies from various users, obscuring the origin and ownership of the funds.

This makes them attractive tools for laundering stolen cryptocurrency.

Lawyers for Tornado Cash co-founder Roman Storm, who pleaded not guilty to US charges in September, did not immediately respond to requests for comment.

The UN sanctions monitors faced a setback when their mandate expired at the end of April due to a Russian veto against its renewal.

Despite this, some monitors submitted incomplete work, including the findings on North Korea’s cryptocurrency activities, to the Security Council’s North Korea sanctions committee.

In addition to cyber theft, the UN monitors have been investigating reports of Russia releasing $9 million of North Korea’s frozen assets and allowing Pyongyang to open an account at a Russian bank in South Ossetia.

This arrangement is reportedly aimed to enhance North Korea’s access to international banking networks.

Furthermore, the monitors observed continued maritime activities suggesting ongoing arms trade between North Korea and Russia.

Ships suspected of carrying weapons have been seen travelling between North Korea’s Rajin port and Russian ports like Vladivostok and Vostochny.

China has also been implicated, with a North Korean vessel reportedly undergoing maintenance at China’s Ningbo port.

The US and its allies have accused North Korea of supplying weapons to Russia for use in the ongoing conflict in Ukraine, a charge both Moscow and Pyongyang deny.

However, both nations have committed to deepening their military cooperation.

In an additional report last month, UN monitors confirmed that debris from a missile that landed in Kharkiv, Ukraine, in January was from a North Korean Hwasong-11 series ballistic missile.

This highlights North Korea’s ongoing missile development and potential involvement in global conflicts.

North Korea’s evasion of UN sanctions continues to be a significant issue.

The monitors documented 208 voyages by North Korean cargo ships suspected of offloading coal in Chinese waters, often through ship-to-ship transfers.

Chinese Coast Guard vessels were observed in proximity to these transfers, raising questions about enforcement and compliance with international sanctions.

The Chinese mission to the UN did not immediately respond to requests for comment on these findings.

(With inputs from Reuters)