North Korea is bullish on bitcoin, and state hackers are getting in on the action

Since May 2017, North Korean actors have unleashed cyberattacks on no fewer than three South Korean cryptocurrency exchanges with the suspected goal of stealing funds, one of which was successful, FireEye said in the report. Some of the attacks were carried out through spear phishing, a process in which a malicious actor sends out fraudulent emails with the intent to distribute malware. The firm suspects North Korean actors emailed documents that appeared to be related to South Korea’s tax deadline to some of South Korea’s cryptocurrency organizations, in an attempt to breach security and steal bitcoin.

These three attacks coincide with a number of recent reports of cyberattacks that involve some combination of North Korea, South Korea, and bitcoin. In April, roughly $5.3 million in bitcoin was reported stolen from Yapizon, a prominent South Korean exchange. In July, news outlets revealed that “billions” of Korean won had been stolen from Bithumb, one of South Korea’s largest exchanges. And most researchers believe the WannaCry ransomware attack, which affected computers at major companies and public institutions worldwide in May, was carried out by North Korea.

It’s possible that North Korea is getting increasingly interested in bitcoin as sanctions limit its already-tight cash reserves even further—the latest round of United Nations sanctions, for example, bans textile exports from the country. After acquiring bitcoin or other cryptocurrencies, North Korea could then launder them on exchanges and get hard cash in return, as its main avenues for making money get cut off one by one.