Key Takeaways
- • North Korea's cyber operations, estimated at 6,000–7,000 state-sponsored hackers across groups including Lazarus and APT38, have systematically stolen cryptocurrency for over 15 years to fund nuclear and missile development programs under heavy UN sanctions.
- • A former FBI analyst reported in June 2022 that North Korea's crypto cache lost up to 85% of its value; FTX's November 2022 bankruptcy collapse has further eroded the regime's digital asset holdings and funding capacity.
- • Despite substantial losses in cryptocurrency valuations and liquidity, analysts assess that North Korea's nuclear weapons development is unlikely to halt or significantly slow, suggesting the regime has diversified or alternative funding mechanisms.
- • Lazarus Group's 2016 near-$1 billion theft attempt from Bangladesh's national bank (which netted $81 million due to a code error) demonstrates the sophistication and scale of North Korean cyber-theft operations, which have since refined their methods.
Summary
North Korea's nuclear arsenal development has been substantially funded through systematic cryptocurrency theft conducted by state-sponsored hacker groups operating under Kim Jong-un's direct control. The regime maintains an estimated 6,000 to 7,000 cyber operatives distributed both domestically and internationally, operating under multiple organizational banners including Lazarus Group (also known as Guardian of Peace and Whois Team) and Advanced Persistent Threat 38 (APT38). This cybercrime infrastructure has been cultivated and expanded over approximately 15 years, positioning North Korea as a formidable threat capable of overwhelming most organizational defenses through sheer force and sophistication.
The recent collapse of FTX, the world's second-largest cryptocurrency exchange, in November 2022 has compounded existing pressures on North Korea's digital asset reserves. Prior to FTX's bankruptcy, a former FBI analyst reported in June 2022 that one of North Korea's major crypto caches had already depreciated by up to 85% in value due to broader cryptocurrency market deterioration. The combination of prolonged crypto market downturn and FTX's systemic failure has substantially diminished the regime's liquid cryptocurrency holdings, which constitute a critical funding source for its nuclear and missile programs.
Lazarus Group's operational history illustrates both the ambition and technical capabilities of North Korean cyber units. In 2016, the group executed a sophisticated heist targeting Bangladesh's national bank, nearly securing $1 billion before a programming error limited the theft to $81 million. Since that incident, North Korean hackers have systematically refined their methodologies, making them increasingly difficult to detect and intercept. These operations have enabled the regime to circumvent international sanctions and maintain independent funding for weapons development despite diplomatic isolation.
However, despite significant erosion of cryptocurrency holdings, financial analysts assess that North Korea's nuclear weapons program will not collapse or meaningfully decelerate. This assessment suggests the regime has either maintained substantial reserves through diversified assets, developed alternative funding channels, or deprioritized crypto-dependent expenditures in favor of retained capital. North Korea's nuclear program has historically persisted through periods of diplomatic engagement and economic pressure, with the regime demonstrating sustained commitment to weapons development regardless of financing constraints or external pressures.
The recent collapse of FTX, the world's second-largest cryptocurrency exchange, in November 2022 has compounded existing pressures on North Korea's digital asset reserves. Prior to FTX's bankruptcy, a former FBI analyst reported in June 2022 that one of North Korea's major crypto caches had already depreciated by up to 85% in value due to broader cryptocurrency market deterioration. The combination of prolonged crypto market downturn and FTX's systemic failure has substantially diminished the regime's liquid cryptocurrency holdings, which constitute a critical funding source for its nuclear and missile programs.
Lazarus Group's operational history illustrates both the ambition and technical capabilities of North Korean cyber units. In 2016, the group executed a sophisticated heist targeting Bangladesh's national bank, nearly securing $1 billion before a programming error limited the theft to $81 million. Since that incident, North Korean hackers have systematically refined their methodologies, making them increasingly difficult to detect and intercept. These operations have enabled the regime to circumvent international sanctions and maintain independent funding for weapons development despite diplomatic isolation.
However, despite significant erosion of cryptocurrency holdings, financial analysts assess that North Korea's nuclear weapons program will not collapse or meaningfully decelerate. This assessment suggests the regime has either maintained substantial reserves through diversified assets, developed alternative funding channels, or deprioritized crypto-dependent expenditures in favor of retained capital. North Korea's nuclear program has historically persisted through periods of diplomatic engagement and economic pressure, with the regime demonstrating sustained commitment to weapons development regardless of financing constraints or external pressures.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.