North Korea Has Stolen More Than Half A Billion Dollars In Cryptocurrency

Could better suits and haircuts be far behind? JL

Kaori Yoshida reports in Nikkei:

The government has stolen money through cyberattacks, creating a pool of illicit funds since 2016. The attacks are conducted by the North Korean military and are an important part of North Korean government policy. Pyongyang has amassed $670 million in foreign and virtual currency through cyberthefts using blockchain technology to cover its tracks. The North launched successful attacks on cryptocurrency exchanges five times, with losses totaling $571 million.Virtual currencies provide ways to evade sanctions. WeChat has also been used to send coordinates and to confirm identity of ships, facilitating illegal trade.
North Korea has used cyberattacks and blockchain technology to circumvent economic sanctions and obtain foreign currency, according to a panel of experts reporting to the U.N. Security Council.
Pyongyang has amassed around $670 million in foreign and virtual currency through cyberthefts, using blockchain technology to cover its tracks, the panel told the Security Council's North Korea sanctions committee in its annual report, Nikkei has learned.
It is the first time the panel has given details on how North Korea obtains foreign currency through cyberattacks.
In its report, the panel recommended that member states "enhance their ability to facilitate robust information exchange on the cyberattacks by the Democratic People's Republic of Korea with other governments and with their own financial institutions," to detect and prevent attempts by North Korea to evade sanctions.
The full report obtained by Nikkei, which has been approved by Security Council members for publication next week, says North Korea waged cyberattacks on overseas financial institutions from 2015 to 2018.
Economic sanctions imposed on Pyongyang over its nuclear and missile programs have restricted the North's exports of coal, a key earner of foreign exchange.
The government has stolen money through cyberattacks, creating a pool of illicit funds that has grown since 2016, the panel said. The attacks are believed to be conducted by a specialized corps within the North Korean military and are now an important part of North Korean government policy.
Over 10 million users of Interpark, a South Korean e-commerce site, have had their personal information stolen in cyberattacks. Hackers demanded a total of $2.7 million in ransom in exchange for returning the stolen data.
The South Korean government has determined that the thefts were carried out by the North. The U.N. experts believe the attacks were aimed at obtaining foreign currency.

The U.N. panel said virtual currencies "provide the Democratic People's Republic of Korea with more ways to evade sanctions, given that they are harder to trace, can be laundered many times and are independent from government regulation." It pointed out that the technologies used in this area are developing rapidly.
The North launched successful attacks on cryptocurrency exchanges in Asia least five times between January 2017 and September 2018, with losses totaling $571 million, the panel estimated.
North Korea is also suspected of using blockchain, the basic technology behind virtual currencies, to get around financial restrictions. One example is Marine Chain, a Hong Kong-based startup that bought and sold ships around the world using blockchain technology. The company is suspected of supplying cryptocurrencies to the North Korean government until it was shut down in September 2018.
North Korean companies were also active on social media, where they used platforms such as YouTube and Instagram to market the country's military equipment, sales of which are subject to international sanctions.
WeChat, a messaging app operated by Chinese tech company Tencent Holdings, has also been used for ship-to-ship transfers of contraband at sea. WeChat has been used to send coordinates and to confirm the identity of ships, facilitating illegal trade with North Korea. The report revealed 148 confirmed cases of smuggling through ship-to-ship transfers between January and August last year.
The panel also reported to the Security Council sanctions committee that North Korea's nuclear and ballistic missile programs "remain intact."
The Hwasong-15 intercontinental ballistic missile, which is believed to be capable of reaching the U.S. mainland, is being assembled at a truck factory in Pyongsong, near Pyongyang, the panel said. The Hwasong-14 ICBM was tested at Pyongyang International Airport.
These facilities have the equipment needed to manufacture, test and transport missiles, including railways and roads. North Korea is dispersing its missile assembly and testing facilities to make them more difficult to destroy in a military strike, U.N. experts said.
The Yonbgyon nuclear complex, which North Korea has offered to dismantle in exchange for corresponding measures by the U.S., has "remained active," the report said. The panel cited satellite imagery of smoke and fluctuating coal reserves by a radiochemical laboratory and an associated steam plant, a sign of potential activity at these facilities.
"In November 2018, a member state reported to the panel that it had detected a heat change within the building," according to the report.
North Korea also appears to be constructing new buildings near its nuclear reactors, based on satellite images taken between February and November of last year, and to be mining uranium.
A separate analysis released by the Center for Strategic and International Studies on Thursday said that North Korea has essentially rebuilt the missile launch pad at Tongchang-ri, returning it to "normal operating status."