From opium to cryptocurrency, North Korea maneuvers to earn hard cash for nuclear program

gettyimagesbank

Reclusive state's illicit activities adapt to changing conditions

By Kang Seung-woo

North Korea has launched various missiles, including intercontinental ballistic missiles, 35 times this year alone, which analysts say could have cost the nation as much as $10 million each. The North's escalation of tensions has raised a burning question among observers: How can the cash-strapped nation finance and sustain its weapons of mass destruction (WMD) program?

Such a question arises as a number of United Nations sanctions have cut North Korea off from conventional revenue sources and forbidden it from exporting coal, iron, lead and seafood ― and consequently, the "rogue state" has set its sights on stealing cryptocurrencies, which are used to fund the development of its WMD.

In the wake of increasing cyber heists, South Korea, the United States and some other countries remain on alert, exploring ways to prevent digital crimes.

To raise funds for its nuclear and ballistic missile programs, the North Korean regime had long relied on a variety of illicit activities, ranging from producing and distributing opium and smuggling cigarettes to counterfeiting U.S. $100 banknotes, dubbed "superdollars."

But as sanctions closed financial channels, the country pivoted to bolstering sophisticated cyber capabilities, thereby generating revenue in ways that are hard to trace and subject to less governmental oversight and regulation.

North Korean leader Kim Jong-un reportedly said in the past, "Cyberwarfare, along with nuclear weapons and missiles, is an 'all-purpose sword' that guarantees our military's capability to strike relentlessly."

Soo Kim, a former CIA analyst now with the RAND Corporation, a think tank in the U.S., has sounded the alarm on the North's crypto-related crimes.

"North Korea's cryptocurrency heists are quite serious given that the proceeds go towards developing the regime's weapons programs. It's a quick study when it comes to finding ways to bypass the international community's watchful eye on sanctions-skirting activities," she said.

"For years we've seen the North Koreans demonstrate impressive ― unfortunately ― cyberhacking capabilities. This skill has now evolved into the cryptocurrency space, which is an attractive environment for Pyongyang as it allows the regime to essentially sweep up huge sums of money with very little manpower or expenditure."

Bruce Klingner, a senior research fellow at the Heritage Foundation, a conservative U.S. think tank, also said Pyongyang has developed a comprehensive and sophisticated arsenal of cyberattack tools and methods that are surpassed by few nations.

"The regime has developed a robust and global array of disruptive military, financial and espionage capabilities which demonstrate the vulnerability of the government, financial, infrastructure and corporate sectors," he said.

"U.S. officials assessed North Korea was one of the top four cyber threats capable of launching 'disruptive or destructive cyberattacks' against the United States and poses a significant threat to the international financial system."

He added: "More worrisome, however, is the possibility that Pyongyang could inflict even greater damage during a crisis or hostilities on the Korean Peninsula."

According to blockchain data analysis firm Chainalysis, North Korea stole as much as $400 million worth of digital assets in 2021 through at least seven attacks on cryptocurrency platforms.

Behind the cybercrimes is Lazarus, a North Korean hacker group, allegedly authorized by North Korea's Reconnaissance General Bureau, Pyongyang's foreign intelligence agency, which is currently subject to both U.S. and U.N. sanctions.

The group was implicated in a $625 million crypto hack against Axie Infinity, a play-to-earn online game, in March, while it was also linked to a theft of $100 million in crypto assets from U.S. blockchain Harmony's Horizon Bridge in June, according to blockchain research firm Elliptic.

Last month, it also conducted cyberattacks targeting Japanese crypto asset companies, according to Japan's Yomiuri Shimbun.

With North Korea's unprecedented cyberspace successes at generating revenue for its nuclear ambitions, South Korea and the U.S. are scrambling to find ways to stop it.

According to the South Korean foreign ministry, Seoul plans to review and seek implementation of various measures in order to block North Korea's securing of funds for nuclear and ballistic missile development through online activities.

"We are closely monitoring trends on North Korea's cryptocurrency theft activities through close cooperation with the U.S.," a ministry official said, Tuesday.

The U.S. Treasury Department also updated its sanctions on cryptocurrency mixer Tornado Cash, Tuesday (local time), alleging the service laundered more than $455 million in virtual currency stolen by Lazarus which was used to support North Korea's WMD program.

In August, the U.S. imposed sanctions on Tornado Cash, making it the second virtual currency mixer to be designated for sanctions by the U.S. government.

In May, Washington imposed sanctions on Blender.io for laundering some $20.5 million out of nearly $620 million stolen by Lazarus from Axie Infinity.

The experts said the current countermeasures against North Korea's expanding cybercrimes targeting cryptocurrencies cannot fully handle them.

"There's awareness that this is going on, and some steps have been taken by the international community to stop such activities. But the fact of the matter is, these crypto sweeps happen within a split second, and by the time we learn of the incident, the regime has already walked away with the cash," Soo Kim said.

"So it's not only greater international community awareness that we need; the laws and regulations guiding crypto conduct have not been completely established, making it a largely uncharted territory for cybercriminal states like North Korea to exploit."

Klingner admitted that the U.S. has taken only limited actions against North Korean hackers and other countries that allow them to operate and launder money from cybercrimes.

"The U.S. should fully enforce existing laws and assess whether additional legislative and executive actions are needed," he said, calling for enhanced regulations on cybercurrency exchanges and decentralized finance.

"Washington should determine a range of punitive steps, both cyber and kinetic, for responding to attacks deemed detrimental to national security."