Image credit: Rin Rothback
February 16, 2022
Following the Crypto
Using Blockchain Analysis to Assess the Strengths and Vulnerabilities of North Korean Hackers
Under heavy and sustained pressure from decades of economic sanctions, North Korea has rapidly expanded its illicit activity within the cyber domain. In particular, Pyongyang has demonstrated an increasing interest in using evolving financial platforms, such as cryptocurrency and blockchain technology, to compensate for the fiscal losses related to economic sanctions on more traditional forms of commercial activity. Since 2014, the Pyongyang-led cybercrime organization known as the Lazarus Group has transformed from a rogue team of hackers to a masterful army of cybercriminals and foreign affiliates, capable of compromising major national financial networks and stealing hundreds of millions of dollars’ worth of virtual assets.
The international community and national governments often incorrectly correlate North Korea’s lack of access to modern computer hardware within its borders to its ability to successfully execute software-reliant cyberattacks. While Beijing and Moscow captivate the attention of most democratic governments concerned about pending cyber intrusions, Pyongyang continues to defy miscalculated expectations by successfully employing myriad sophisticated cyberattacks that target new and developing financial technology. North Korea will likely continue to adapt its cybercrime tactics targeting cryptocurrency to circumvent obstacles presented by economic sanctions on more traditional forms of financial activity and commerce.
While Beijing and Moscow captivate the attention of most democratic governments concerned about pending cyber intrusions, Pyongyang continues to defy miscalculated expectations.
This report provides in-depth analysis of North Korea’s demonstrated ability to exploit financial technologies, in particular cryptocurrencies and blockchain technology, to procure funds for its illicit nuclear and ballistic weapons development programs. This research was supported through blockchain analysis conducted in partnership with TRM Labs, a leading blockchain intelligence firm that seeks to monitor, investigate, and mitigate crypto fraud and financial crime.
Through analyzing three case studies of major North Korean hacks, this report outlines key strengths and vulnerabilities in the Lazarus Group’s campaigns to infiltrate cryptocurrency exchanges and steal, launder, and liquidate funds. The report also provides a snapshot of key policy oversights within the regulatory environment in the crypto space of central stakeholders and countries, such as China, the United States, and South Korea. Lastly, this study offers a prospective look into the future of North Korea–led crypto hacks and provides a series of policy recommendations to strengthen cyber resilience against these efforts.
Summary of Recommendations
The following recommendations are proposed for U.S. domestic and foreign policymakers, as well as those in the private sector:
U.S. Domestic Policymakers
- Financial regulators and lawmakers should work to remove any loopholes that allow decentralized finance (DeFi) platforms and other emerging financial technology to circumvent U.S. regulations on anti–money laundering (AML) and combating the financing of terrorism (CFT).
- Congress should adopt legislation that requires all cryptocurrency exchanges to report cyber incidents to the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the FBI that could involve the financial and/or personal information of U.S. citizens and/or entities.
- Within the new National Cryptocurrency Enforcement Team, the executive branch should designate specific research on state-sponsored cybercrime groups.
U.S. Foreign Policymakers
- The U.S. Department of the Treasury should expand sanctions designations to any individual or entity supporting and/or facilitating North Korean cybercrime, including foreign over-the-counter (OTC) brokers and telecommunications companies that provide to North Korea technical services, know-how, and equipment that its hackers use to conduct malicious cyber operations.
- The U.S. government should incorporate specific joint research and investigative initiatives on cryptocurrency-related illicit activity within the ongoing U.S.-ROK cyber working group established during the 2021 Biden-Moon Summit.
- The U.S. government should enhance overall cyber-related intelligence sharing and communication channels with Southeast Asian allies and partners to foster greater understanding of cybersecurity risks.
- The Financial Crime Enforcement Network (FinCEN) should engage with relevant foreign legislative and enforcement bodies to require that virtual asset service providers (VASPs) operating or seeking to operate within their jurisdictions fully implement all Financial Action Task Force (FATF) guidance on virtual assets.
Private Sector Actors
- All cryptocurrency exchanges should adopt company-wide best practices for increased cyber hygiene, such as incorporating relevant CISA guidelines on cybersecurity and executing mock email phishing campaigns for all employees.
Download the Full Report
More from CNAS
The Lawfare Podcast: A New Sanctions Approach for Humanitarian Assistance
For years, the international community has wrestled with how to reconcile sanctions policies targeting terrorist groups and other malevolent actors with the need to provide hu...
By Alex Zerden
Is a TikTok Ban in the Cards?
Emily Kilcrease joins BBC Newshour to discuss growing security concerns in the U.S. over TikTok and debates whether a ban is feasible, desirable, and likely. Listen to the fu...
By Emily Kilcrease
Sound On: Foreign Tech Ban, Jan 6 Tape, Tim Ryan on Energy
The Sound On Podcast speaks to Emily Kilcrease, Senior Fellow and Director of the Energy, Economics, and Security Program the Center for a New American Security on new legisla...
By Emily Kilcrease
Sanctions by the Numbers: SDN, CMIC, and Entity List Designations on China
The United States has progressively expanded the scope of sanctions and entity-based export controls on Chinese persons (i.e., individuals and entities), primarily through the...
By Emily Kilcrease & Michael Frazer