cta-2023-1130.pdf (2 MB)

Recorded Future's Insikt Group assesses that North Korea has treated cryptocurrency theft as a major revenue source since shifting from SWIFT-focused financial intrusions toward crypto targets during the 2017 market boom. The report estimates about $3 billion in cryptocurrency stolen since 2017, including $1.7 billion in 2022, and says North Korean actors accounted for 44% of stolen cryptocurrency that year. Targets include exchanges, individual users, venture capital firms, and alternative crypto technologies, with laundering and fiat conversion methods that resemble cybercriminal tradecraft but operate at state-backed scale. The source links the activity to sanctions evasion and regime revenue, including funding pressure around military and weapons programs.