Confidential UN Report Exposes Lazarus Group’s $147.5M Stolen Crypto Transfer to North Korea

Author: Chayanika Deka 

Last Updated May 19, 2024


A UN report shows that North Korean hackers sent millions of stolen cryptocurrency through Tornado Cash last year.

A confidential United Nations report obtained by Reuters reveals that North Korea’s notorious cybercriminal group known as the Lazarus Group transferred millions of stash of stolen cryptocurrency back to the Asian country last year.

In March 2023, these North Korean hackers illicitly took $147.5 million worth of cryptocurrency from HTX, a crypto exchange owned by TRON founder Justin Sun. A year later, they funneled the funds into the isolated nation using the sanctioned crypto mixer Tornado Cash.

North Korea’s Cyber Warfare

According to a report submitted last week, the monitors told a United Nations Security Council (UNSC) sanctions committee that they had been probing 97 suspected North Korean cyberattacks on cryptocurrency firms between 2017 and 2024, valued at approximately $3.6 billion.

The monitors also reported that North Korean IT workers abroad earn significant income for their country based on information from U.N. member states and private companies. They were also looking into a New York Times report from February 6, which claimed that Russia had released $9 million out of $30 million in frozen North Korean assets and had permitted Pyongyang to open an account at a Russian bank in South Ossetia, facilitating better access to international banking networks.

The Lazarus Group and other North Korean hackers have executed some of the most lucrative hacks in the crypto and DeFi sectors, and Tornado Cash has been their go-to tumbler.

In 2022, the US sanctioned Tornado Cash, accusing it of aiding North Korea. In 2023, two of its co-founders were charged with facilitating over $1 billion in money laundering, including for a cybercrime group associated with North Korea.
North Korea’s Diverse Targets in $1B Crypto Theft

An earlier report released by the UNSC revealed that North Korea acquired 50% of its foreign exchange earnings from cyberattacks. The nation expanded its targeting of cryptocurrency platforms in 2023, hitting more than ever before.

However, the total amount stolen was lower compared to 2022, according to Chainalysis. Despite this decrease, the number of hacks reached a record high of 20, coinciding with a general downturn in the crypto market.

In 2023, the blockchain analysis firm estimated that the total stolen cryptocurrency amounted to just over $1 billion. Notably, North Korean hackers concentrated on DeFi, stealing approximately $429 million in the process. They also targeted centralized services, exchanges, and wallet providers, where they pilfered $150 million, $330.9 million, and $127 million, respectively.