North Korea's Hacking Units — From Online Games to Cryptocurrency

SECURITY REPORT · APT / DPRK · 2025.03

The Evolution of Cyber Attack Organizations Under the Reconnaissance General Bureau — Threat Analysis & Defense Guide

Table of Contents

1. North Korea's Hacking Organization Structure
2. History of Hacking — From Game Bots to Central Banks
3. Upbit Hack — A Turning Point Targeting Crypto
4. Infiltration via Telegram and Crypto Communities
5. Developer Impersonation — The Most Sophisticated Social Engineering Attack
6. Bybit Hack — The Largest Single Crypto Theft in History
7. Money Laundering Methodology and Tracking Limitations
8. Key Observations — AI Advancement and Industrialization of Attacks
9. Defensive Checklist for Individuals and Enterprises
10. References

1. Organization Structure

North Korea's cyberattacks are not the work of individuals or private groups. They are a systematic, state-level cyber force operating directly under the Reconnaissance General Bureau (RGB) of the Korean Workers' Party. Established in 2009 by merging the Party's Operations Department, Bureau 35, and the Military's Reconnaissance Bureau, the RGB is composed of six directorates and directly commands the core hacking units.

⚠️ The Significance of State-Sponsored Hacking

These are not mere criminal gangs — they receive state funding and military technology support. The United Nations Security Council has repeatedly confirmed that funds stolen through hacking are diverted to finance nuclear weapons and ballistic missile development.

Major Hacking Units

📊 AhnLab 2025 Report: North Korea's APT attacks (86 cases) far exceed China (27) and Russia (18).

2. History of Hacking

North Korea's hacking strategy evolved in stages — from selling game automation software for foreign currency in the early days, to infiltrating financial networks, deploying global ransomware, and ultimately stealing cryptocurrency.

📅 Timeline

Early 2000s — Online Game Bot Programs (First Foreign Currency Scheme)

Via Korea Computer Center and Ryonghakdo Trading Corporation, North Korea developed and sold automation (bot) programs for games like Lineage, MapleStory, and Dungeon & Fighter. Revenues flowed through Bureau 39 into the ruling fund. One private server operator was arrested under the National Security Act after purchasing hacking tools from North Korean hackers and sending KRW 23.8 million to a Chinese bank account.

2009 — Operation Troy

Targeting South Korean and US Forces Korea military. Malware lay dormant for at least four years collecting military intelligence from government and military computers. DDoS attacks simultaneously hit the Blue House website.

2014 — Sony Pictures Hack / KHNP Hack

Sony Pictures was breached in retaliation for the film The Interview (depicting Kim Jong-un's assassination), destroying internal networks. The FBI officially named North Korea as the perpetrator. Domestically, blueprints of nuclear power plants at Korea Hydro & Nuclear Power were stolen.

2016 — Bangladesh Bank Heist $81M stolen

SWIFT payment systems were hacked to issue fraudulent wire transfer instructions to the US Federal Reserve. Funds were laundered through Philippine casinos. Attributed to Bluenoroff.

2017 — WannaCry Ransomware [CRITICAL]

300,000 computers infected across 150 countries. UK National Health Service paralyzed. Exploited the NSA-leaked EternalBlue vulnerability. US and UK governments officially blamed North Korea.

2019 — Upbit Ethereum Theft $52M stolen (KRW 58 billion)

342,000 ETH stolen. After five years of investigation, confirmed as a joint operation by Lazarus and Andariel. Current market value: approximately KRW 1.47 trillion.

2024 — All-Out Assault on Defense Contractors

Three units (Lazarus, Andariel, Kimsuky) deployed simultaneously. 83 defense companies targeted; 10+ successfully breached.

2025 — Bybit Hack $1.46B stolen

A single developer's PC infection led to the largest single crypto theft ever. North Korea's 2025 total crypto theft surpassed $2 billion.

3. Upbit Hack

The November 2019 Upbit hack marked a decisive strategic pivot from traditional finance to cryptocurrency exchanges.

[Incident Summary]
Stolen    : 342,000 ETH (~$52M at the time / ~$1.47T KRW at current price)
Date      : November 2019
Confirmed : November 2024 (National Investigation Headquarters, Korea National Police)
Perpetrators: Lazarus + Andariel (joint operation)
Investigation: FBI cooperation; North Korean IPs and vocabulary ('heolhan il') confirmed

Post-Theft Money Laundering Route

1. North Korean Proprietary Exchanges (57%) — ETH converted to BTC at 2.5% below market rate via 3 anonymous exchanges designed and operated by North Korea. No external KYC required; instantly cashed out.
2. 51 Exchanges Across 13 Countries (43%) — Funds dispersed through exchanges in China, the US, Hong Kong, Switzerland, etc. to obscure origins and complicate international tracking.
3. Chinese OTC Brokers and Underground Finance — Converted to fiat currency via UnionPay card-linked accounts. Final cash-out with collaboration from organized crime groups such as the Triads.

4. Telegram Infiltration

Telegram's encrypted messaging, anonymity, and bot automation have made it a primary communication channel for the crypto community — and North Korea's key vector for deploying malware and reaching victims.

Malware Capabilities (NimDoor Family)

Keylogging        : Records all keystrokes → steals passwords and seed phrases
Clipboard Monitor : Replaces copied wallet addresses with attacker's addresses in real time
Browser Data      : Steals stored credentials, cookies, and sessions
Wallet Extensions : Steals data from 24+ wallet extensions including MetaMask
Remote Control    : Remotely controls webcam and microphone; transfers or deletes files
Telegram Data     : Runs script (tlgrm) to exfiltrate local Telegram data
Persistence       : Registers LaunchAgent (macOS) to auto-execute after reboot

5. Developer Impersonation

The most prominent tactic in 2024–2025 is posing as IT developers or engineers and obtaining legitimate employment at crypto firms. According to a Chainalysis report, more than 12 crypto companies in 2024 alone were infiltrated by North Korean operatives as legitimate employees.

⚠️ The Neutralization of Perimeter Security

When an attacker already holds legitimate internal access, firewalls and network perimeter defenses are rendered ineffective. This strategy creates a fundamental trust crisis across the entire industry.

Attack Stages

1. Building a Fake Identity — Combine AI-generated photos, fabricated work history, and ghost company references. Build an activity history on LinkedIn and GitHub over time.
2. Applying for Remote Positions — Target high-demand roles such as blockchain developer or smart contract engineer. Possess skills sufficient to pass technical interviews.
3. Internal Reconnaissance — While working as a legitimate employee, quietly map internal infrastructure, security architecture, and private key management over months.
4. Execution — Assisting the Attack from Inside — Provide credentials, disable security systems, approve fraudulent transactions to directly support the external hacking team.

Malicious Open Source Attack via GitHub

// Attack Flow (Exploiting VSCode Automation)
Step 1: Upload a malicious repository disguised as a legitimate open-source project to GitHub
Step 2: Developer clones the repo and opens the folder in VSCode
Step 3: .vscode/tasks.json automatically executes the malicious script
Step 4: Malware payload disguised as .woff2 or .svg files to bypass security scans
Step 5: Exfiltrates browser credentials + data from 24+ wallet extensions
// Target OS: Windows / macOS / Linux — all covered

6. Bybit Hack

"Seventeen days after infecting one developer's MacBook, North Korea's Lazarus stole $1.5 billion through a single compromised node."

— BlockEden Analysis Report, February 2026

7. Money Laundering

8. Key Observations

9. Defensive Checklist

💡 Core Principle: North Korea's attacks target human trust and habits more than technical vulnerabilities. Technical security measures must be paired with a security culture centered on people, processes, and supply chain integrity.

Basic Defense Practices

• [ ] Telegram DMs: Never respond to investment proposals, files, or links from unknown contacts. Always verify the identity of apparent contacts through a separate channel.
• [ ] Hardware Wallet: Store significant assets in cold storage. Keep only small amounts for daily transactions in hot wallets.
• [ ] Clipboard Hijacking: Always visually verify the full wallet address immediately before sending. Use a clipboard monitoring security solution.
• [ ] Job Offer Emails: Immediately refuse any request to run task files. Verify identity through official channels.
• [ ] Open Source Code: Manually review .vscode/tasks.json and package.json scripts before execution. Disable VSCode auto-run.
• [ ] Supply Chain Audit: Regularly audit third-party libraries and services. Conduct thorough background checks when hiring contract developers.

Two-Factor Authentication (2FA) — Last Line of Defense Against Account Takeover

🔐 An Account Without 2FA Is a Safe Without a Lock

Even if a password is stolen, an attacker cannot enter an account protected by 2FA without passing a second verification step.

2FA Priority Order: Exchange accounts > Email accounts > Telegram/Social media > Cloud storage

For exchange API keys: always restrict to withdrawal disabled / read-only permissions + IP whitelist.

PC Cafes and Public Internet — Never Access Crypto

⛔ 4 Threats When Using Public Computers

1. Keyloggers Cannot Be Detected — Malware or keyloggers may already be installed and are invisible to the naked eye.
2. Browser Sessions Linger — Even after logging out, authentication data can remain in cache and cookies, exposed to the next user.
3. Man-in-the-Middle Attack (MITM) — On open networks (cafes, libraries, airports), attackers on the same network can intercept traffic or redirect you to a rogue access point.
4. Shoulder Surfing — Seed phrases and passwords entered in public may be seen by bystanders or captured by CCTV.

✅ Rules to Follow:

• [ ] Access crypto exchanges and wallets only from your own personal device (smartphone or laptop)
• [ ] If you must use a public PC, never enter seed phrases, private keys, or passwords
• [ ] Use a trusted, paid VPN before connecting to public Wi-Fi
• [ ] Install exchange apps only from official app stores — never via QR code or link
• [ ] Never expose your 2FA codes during screen sharing or livestreaming (streamers/YouTubers take special care)

❌ Never Do This:

• Rely solely on clearing browser history after using a PC cafe (useless if a keylogger is installed)
• Access a personal wallet or exchange over a PC cafe's LAN without a personal hotspot
• Log into an exchange on someone else's device ("just a quick look")

Checklist for Exchange and Project Operators

✅ Must Implement:

• [ ] Limit hot wallet assets to no more than 10% of total; keep the rest in cold storage
• [ ] Audit security of the multi-sig wallet signing infrastructure itself — including third-party services (Bybit lesson)
• [ ] Enforce FIDO2 hardware key-based 2FA on all admin accounts
• [ ] Implement additional identity verification procedures for remote hires, accounting for deepfake risk
• [ ] Monitor internal access logs in real time and configure immediate alerts for anomalous behavior
• [ ] Deploy endpoint security solutions on developer machines; restrict installation of external software

❌ Strictly Prohibited:

• Deploying SDKs or libraries from unverified sources directly to production
• Processing large withdrawal requests via automated systems alone (no human verification step)
• Approving transactions without real-time cross-referencing against North Korea-sanctioned blockchain address databases

References

All statistics, events, and claims in this report are based on the public sources listed below. Items where investigation results remain unconfirmed are described within the scope of information publicly available at the time of writing.

Government and Law Enforcement

Security Firms and Blockchain Analytics

Media and Investigative Journalism

GitHub

About the Author — Dennis Kim
Dennis Kim is a quantitative analyst and AI researcher operating at the convergence of artificial intelligence and global financial markets. Since 2017, he has been deeply engaged in the blockchain industry, emerging as a key player connecting Korea and the broader Asian market—bridging ecosystems, capital, and technology across the region.

He served as CEO of Cyworld (Cyworld Z), steering one of Korea's most iconic social platforms, and built his foundation as a hands-on programmer with deep roots in the game security industry. Microsoft recognized his technical leadership with the Azure MVP award for nine consecutive years (2015–2023), and he remains an active cyber threat intelligence and security expert, publishing multilingual threat research read across the industry.

As a columnist, Dennis writes for both technical and general audiences, translating complex macroeconomic narratives and AI-driven signals into clear, actionable insight. Today, much of that work lives in his Vibe Investing repository, where he publishes deep-dive investment columns and develops AI-driven trading systems—turning the noise of markets and machine learning into a coherent investment edge.

His current focus sits squarely on the future he's spent his career preparing for: the fusion of AI and financial markets, where engineering rigor, security discipline, and market intuition meet.