North Korea's Crypto Heists Surpass $650 Million in 2024, Authorities Claim

In a significant development, hackers from North Korea have been linked to cryptocurrency thefts totaling $659 million in 2024 alone, according to a recent joint statement by the United States, Japan, and South Korea. The statement detailed five major incidents, including a newly attributed $235 million heist from the Indian crypto exchange WazirX by the notorious Lazarus Group. This group has been responsible for several high-profile cyberattacks over the past decade, including a significant $625 million theft from Axie Infinity in 2022.

Amongst these incidents, Japan's DMM Bitcoin faced the largest blow, losing $308 million. This massive loss ultimately forced the exchange to shut down operations. The three countries are united in addressing these cyber threats, noting that North Korean attackers have been employing advanced social engineering tactics to execute these heists. Common methods involve deploying malware under the guise of legitimate applications like TraderTraitor and AppleJeus.

"As recently as September 2024, the United States government observed aggressive targeting of the cryptocurrency industry by the DPRK with well-disguised social engineering attacks that ultimately deploy malware, such as TraderTraitor, AppleJeus and others. The Republic of Korea and Japan have observed similar trends and tactics used by the DPRK."

A previous warning from the FBI highlighted the North Korean strategy to use "individualized fake scenarios," such as false job and business proposals, to deliver their malicious payloads. Authorities from all three nations urge businesses within the cryptocurrency sector to review these warnings diligently, to avoid "inadvertently hiring DPRK IT workers." This advice was echoed in a recent report by CoinDesk detailing the infiltration tactics.

Furthermore, phishing tactics continue to be a popular tool in their arsenal, particularly against employees within cryptocurrency firms. These scams often involve convincing impersonations of trusted individuals within the industry, complete with realistic photos and information, presumably harvested from social media profiles.