May 09, 2022

Pyongyang Pays South Korean Citizens in Crypto to Sell Military Secrets

Seoul recently arrested two South Korean citizens, a 38-year-old cryptocurrency exchange operator (Lee) and a 29-year-old army captain, on charges of espionage related to selling military secrets to Pyongyang. According to reports, a North Korean operative met Lee through an undisclosed online cryptocurrency forum in 2016 and offered him cryptocurrency in exchange for his assistance with ongoing clandestine operations. South Korean media also claims that the two communicated through the private messaging app Telegram. While such features are not inherently bad, criminals have consistently used end-to-end message encryption features and other privacy protocols specific to applications like Telegram to coordinate, propagate, and monetize illicit activity.

The Korean National Policy Agency stated that the North Korean operative paid Lee roughly $600,000 and the army captain about $38,800 in cryptocurrency for their participation. Since Lee has been in contact with the operative since 2016, there are serious concerns over his participation in other incidents of attempted, or successful, espionage against Seoul. Although Pyongyang has a documented history of recruiting South Korean citizens for espionage through coercion and seduction, this is the first known public case of North Korea paying foreign agents in cryptocurrency to commit espionage and an active-duty military captain collaborating with a North Korean hacker.

Cryptocurrency is not only a financial asset to steal and launder, but also a lucrative tool to help fund global espionage and recruit foreign agents.

Interestingly, one of the operations tasked to Lee involved recruiting the active-duty South Korean military captain. When recruited, the captain provided Pyongyang with log-in credentials necessary to access the Korean Joint Command and Control System (KJCCS), which the South Korean Joint Chiefs of Staff use to assess C4I (command, control, communications, computer, and intelligence) capabilities during military drills, training, and operations. Through Telegram, the North Korean operative also ordered Lee to send spycam equipment to the captain in order to photograph items and information of interest to Pyongyang. The equipment included a wristwatch fitted with a secret camera and USBs loaded with “poison tabs,” a hacking tool that allows one to compromise a computer through its USB port for various purposes, such as stealing information, gaining unauthorized control of the device, and more.

Read the full article from The Diplomat.

  • Video
    • December 2, 2024
    Ziemba: China Could Impose Retaliatory Tariffs on U.S.

    If tariffs and costs continue to rise, it will not be great for oil demand within the US, that's according to Rachel Ziemba, Adjunct Senior Fellow at the Center for a New Amer...

    By Rachel Ziemba

  • Podcast
    • November 26, 2024
    Trump’s Treasury and Commerce nominations + Nippon Steel’s bid for U.S. Steel

    Emily and Geoff react to the nominations of Scott Bessent for U.S. Treasury Secretary and Howard Lutnick for U.S. Commerce Secretary and overall point man for trade and tariff...

    By Emily Kilcrease & Geoffrey Gertz

  • Commentary
    • Sharper
    • November 20, 2024
    Sharper: Trump 2.0

    Donald Trump's return to the White House is widely expected to reshape America's global priorities. With personnel choices and policy agendas that mark a significant break fro...

    By Charles Horn & Gwendolyn Nowaczyk

  • Podcast
    • November 14, 2024
    Trump 2.0's Economic Security Agenda

    Emily and Geoff switch from obsessing over the election to obsessing over the transition. They dig into what a Trump 2.0 presidency will mean for tariffs, sanctions, export co...

    By Emily Kilcrease & Geoffrey Gertz

View All Reports View All Articles & Multimedia