North Korea hacked $3bn in crypto says leaked UN document is profiled by BTW Media because published evidence links it to internet infrastructure, governance, operational dependencies, or market visibility.
North Korea hacked $3bn in crypto says leaked UN document is tracked as a internet infrastructure institution within the internet infrastructure ecosystem.
North Korea hacked $3bn in crypto says leaked UN document has public-source relevance to network operations, governance, dependency mapping, or market structure.
North Korea hacked $3bn in crypto says leaked UN document has public-source relevance to network operations, governance, dependency mapping, or market structure.
North Korea hacked $3bn in crypto says leaked UN document is tracked as a internet infrastructure institution within the internet infrastructure ecosystem.
Public-source signals support medium-impact monitoring for infrastructure visibility and dependency analysis.
North Korea hacked $3bn in crypto says leaked UN document is profiled by BTW Media because published evidence links it to internet infrastructure, governance, operational dependencies, or market visibility.
Public-source signals support medium-impact monitoring for infrastructure visibility and dependency analysis.
| 0.90–1.00 | A | High — direct sources |
| 0.75–0.89 | A/B | Strong |
| 0.55–0.74 | B/C | Medium |
| 0.35–0.54 | C/D | Weak–medium |
| 0.10–0.34 | D | Weak signal |
| 0.00–0.09 | D | Internal monitoring |
Several public sources
- North Korea reportedly stole $147.5 million from the HTX cryptocurrency exchange late last year and laundered it through Tornado Cash in March, according to confidential UN documents.
- UN monitors have identified 97 cyberattacks by North Korea on cryptocurrency firms from 2017 to 2024, totalling approximately $3.6 billion.
- Despite ongoing international sanctions, North Korea continues to engage in illicit activities, including arms trading and coal exports, to fund its nuclear and missile programs.
Recent revelations from UN sanctions monitors allege that North Korea laundered $147.5 million through the virtual currency platform Tornado Cash, part of broader cyberattacks on cryptocurrency exchanges amounting to billions.
Also read: Is Binance safe for storing cryptocurrency? An analysis
Cyber crimes and sanctions evasion
The monitors told a U.N. Security Council sanctions committee in a document submitted on Friday that they had been investigating 97 suspected North Korean cyberattacks on cryptocurrency companies between 2017 and 2024, valued at some $3.6 billion.
The $147.5 million stolen from HTX was traced by blockchain research firms PeckShield and Elliptic to Tornado Cash, a mixer platform that obscures the origins of digital currencies.
This is part of a wider pattern that saw North Korean-linked cyberattacks targeting cryptocurrency exchanges and companies, accumulating illicit gains worth billions.
Also read: Security for cryptocurrency exchanges
Ongoing maritime sanctions violations
North Korea continues to evade maritime sanctions imposed by the United Nations. The monitors reported that North Korea had conducted over 208 voyages to offload coal in Chinese waters, most of which were likely done via ship-to-ship transfers.
Surveillance has occasionally spotted Chinese coast guard vessels near these operations, raising questions about the enforcement of international sanctions.
There have been continued arms trade activities between North Korea and Russia, with ships frequently travelling between North Korean and Russian ports. This includes the transfer of weapons which are suspected to be used in conflict regions such as Ukraine, despite both North Korea and Russia denying these claims.
International reactions and responses
The ongoing defiance of UN sanctions by North Korea has prompted calls for more stringent international measures to curb the regime’s illicit activities. The United States has already taken steps by sanctioning platforms like Tornado Cash.
However, the effectiveness of these sanctions remains hindered by complex geopolitical dynamics and the sophisticated nature of North Korea’s evasion strategies.
At A Glance
- Name: North Korea hacked $3bn in crypto says leaked UN document
- Type: Internet infrastructure institution
- Base: Asia Pacific
- Profile focus: Institution
What It Does
- Public records support monitoring of its role, services, and key relationships.
Why It Matters
- Public-source signals support medium-impact monitoring for infrastructure visibility and dependency analysis.
- Operational criticality: Medium
- Time horizon: Next quarter
What To Watch
- Monitoring focuses on verified service continuity, governance changes, and relationship signals.
Track verified source updates, role changes, and current public evidence.
Public-source signals support medium-impact monitoring for infrastructure visibility and dependency analysis.
Longer-term relevance depends on verified operating, policy, and relationship changes.
Member Briefing
Deeper Profile Context
Login is required to unlock the full profile briefing and source notes.
Only for Strategy Circle
Strategic Circle Access
Open to all readers. Unlock profile briefings after joining and logging in.
Join Strategic CircleOnly for Leadership Alliance
Leadership Alliance Access
For owners and management of IP-holding companies. Login required to unlock.
Join Leadership Alliance


