Institution Profiling / Internet infrastructure institution

North Korea hacked $3bn in crypto says leaked UN document

North Korea hacked $3bn in crypto says leaked UN document is tracked as a internet infrastructure institution within the internet infrastructure ecosystem.

North Korea hacked $3bn in crypto says leaked UN document
Caption: North Korea hacked $3bn in crypto says leaked UN document visual context for BTW intelligence coverage. · Source context: Existing article media was retained or restored as the subject-specific visual basis. · Relevance reason: North Korea hacked $3bn in crypto says leaked UN document is the primary subject or event subject; the image supports the article's market reading. · Image provenance: Existing curated article image retained because it is subject- or event-specific and not a generic pool placeholder.

Sources

Public references used for this article.

CategoryInstitution

North Korea hacked $3bn in crypto says leaked UN document is tracked as a internet infrastructure institution within the internet infrastructure ecosystem.

RegionAsia Pacific

North Korea hacked $3bn in crypto says leaked UN document has public-source relevance to network operations, governance, dependency mapping, or market structure.

Signal FocusInternet infrastructure institution

North Korea hacked $3bn in crypto says leaked UN document has public-source relevance to network operations, governance, dependency mapping, or market structure.

Content TypeProfile

North Korea hacked $3bn in crypto says leaked UN document is tracked as a internet infrastructure institution within the internet infrastructure ecosystem.

Primary DomainSecurity

Public-source signals support medium-impact monitoring for infrastructure visibility and dependency analysis.

TopicInternet infrastructure institution

North Korea hacked $3bn in crypto says leaked UN document is profiled by BTW Media because published evidence links it to internet infrastructure, governance, operational dependencies, or market visibility.

ImpactMedium

Public-source signals support medium-impact monitoring for infrastructure visibility and dependency analysis.

Confidence?Confidence Grade
0.90–1.00AHigh — direct sources
0.75–0.89A/BStrong
0.55–0.74B/CMedium
0.35–0.54C/DWeak–medium
0.10–0.34DWeak signal
0.00–0.09DInternal monitoring
Limited confidence (72%)

Several public sources

North Korea hacked $3bn in crypto says leaked UN document is profiled by BTW Media because published evidence links it to internet infrastructure, governance, operational dependencies, or market visibility.

  • North Korea reportedly stole $147.5 million from the HTX cryptocurrency exchange late last year and laundered it through Tornado Cash in March, according to confidential UN documents.
  • UN monitors have identified 97 cyberattacks by North Korea on cryptocurrency firms from 2017 to 2024, totalling approximately $3.6 billion.
  • Despite ongoing international sanctions, North Korea continues to engage in illicit activities, including arms trading and coal exports, to fund its nuclear and missile programs.

Recent revelations from UN sanctions monitors allege that North Korea laundered $147.5 million through the virtual currency platform Tornado Cash, part of broader cyberattacks on cryptocurrency exchanges amounting to billions.

Also read: Is Binance safe for storing cryptocurrency? An analysis

Cyber crimes and sanctions evasion

The monitors told a U.N. Security Council sanctions committee in a document submitted on Friday that they had been investigating 97 suspected North Korean cyberattacks on cryptocurrency companies between 2017 and 2024, valued at some $3.6 billion.

The $147.5 million stolen from HTX was traced by blockchain research firms PeckShield and Elliptic to Tornado Cash, a mixer platform that obscures the origins of digital currencies.

This is part of a wider pattern that saw North Korean-linked cyberattacks targeting cryptocurrency exchanges and companies, accumulating illicit gains worth billions.

Also read: Security for cryptocurrency exchanges

Ongoing maritime sanctions violations

North Korea continues to evade maritime sanctions imposed by the United Nations. The monitors reported that North Korea had conducted over 208 voyages to offload coal in Chinese waters, most of which were likely done via ship-to-ship transfers.

Surveillance has occasionally spotted Chinese coast guard vessels near these operations, raising questions about the enforcement of international sanctions.

There have been continued arms trade activities between North Korea and Russia, with ships frequently travelling between North Korean and Russian ports. This includes the transfer of weapons which are suspected to be used in conflict regions such as Ukraine, despite both North Korea and Russia denying these claims.

International reactions and responses

The ongoing defiance of UN sanctions by North Korea has prompted calls for more stringent international measures to curb the regime’s illicit activities. The United States has already taken steps by sanctioning platforms like Tornado Cash.

However, the effectiveness of these sanctions remains hindered by complex geopolitical dynamics and the sophisticated nature of North Korea’s evasion strategies.

At A Glance

  • Name: North Korea hacked $3bn in crypto says leaked UN document
  • Type: Internet infrastructure institution
  • Base: Asia Pacific
  • Profile focus: Institution

What It Does

  • Public records support monitoring of its role, services, and key relationships.

Why It Matters

  • Public-source signals support medium-impact monitoring for infrastructure visibility and dependency analysis.
  • Operational criticality: Medium
  • Time horizon: Next quarter

What To Watch

  • Monitoring focuses on verified service continuity, governance changes, and relationship signals.
NowMedium priority

Track verified source updates, role changes, and current public evidence.

QuarterMedium policy sensitivity

Public-source signals support medium-impact monitoring for infrastructure visibility and dependency analysis.

YearNext quarter outlook

Longer-term relevance depends on verified operating, policy, and relationship changes.

Member Briefing

Deeper Profile Context

Login is required to unlock the full profile briefing and source notes.

Only for Strategy Circle

Strategic Circle Access

Open to all readers. Unlock profile briefings after joining and logging in.

Join Strategic Circle

Only for Leadership Alliance

Leadership Alliance Access

For owners and management of IP-holding companies. Login required to unlock.

Join Leadership Alliance
← BackAll Companies