North Korean Cryptocurrency Operations: An Alternative Revenue Stream

Executive Summary

As cryptocurrency has risen to prominence within the past decade, its widespread use has like- wise created great potential for exploitation by malicious actors. With a cyber arsenal capable of reaching cryptocurrency platforms and users, North Korea has increasingly targeted virtual assets as a source of revenue for its regime. In its 2021 final report, the United Nations Panel of Experts estimated that North Korea stole approximately $316.4 million in virtual assets between January 2019 and November 2020. The decentralized nature of the cryptocurrency market is well-suited for a heavily-sanctioned and financially-isolated state like North Korea, especially given tighter trade restrictions and border closures during the COVID-19 pandemic. The ease of obscuring ownership of virtual assets and the lack of regulatory oversight make cryptocurrency all the more attractive for North Korea.

Although North Korean cyber operations have been widely publicized, the purpose of this report is to focus on three ways North Korea obtains cryptocurrencies, specifically cryptomining, cryptojacking, and fraudulent initial coin offerings (ICOs). Given observed trends and changes in the cryptocurrency environment—namely, the rise of decentralized finance (DeFi) and over-the-counter brokers—this paper finds that North Korea’s crypto operations are consistent with its national objectives and likely to continue. Second, North Korea’s cryptocurrency operations offer an attractive and transferable model for other financially-isolated states and non-state actors. Finally, governments should work with law enforcement agencies, multilateral institutions, and non-traditional actors to mitigate the national security threat from North Korea’s cryptocurrency activities.