North Korea Illegally Steals Virtual Assets Worth 4 Trillion Won... Cashed Out Through Chinese and Russian Brokers

It has been estimated that North Korea illegally stole virtual assets worth 4 trillion won (2.85 billion dollars) from January last year to September this year. The stolen virtual assets were reportedly converted into cash through overseas brokers based in countries such as China and Russia.

The Multinational Sanctions Monitoring Team (MSMT), which is led by South Korea, the United States, and Japan and includes a total of 11 participating countries, published a report on October 22 containing these findings on the implementation of sanctions against North Korea. This report, which focuses on "North Korea's Illegal Cyber Activities," is the second of its kind, following the first report released in May.

According to the report, North Korea stole virtual assets worth 2.32 trillion won (1.65 billion dollars) just this year. North Korea laundered these stolen virtual assets and cashed them out through overseas brokers based in China, Russia, Hong Kong, Cambodia, and other countries. North Korean overseas IT personnel, numbering approximately 1,000 to 2,000, are currently residing in at least eight countries, including these nations. They are affiliated with subordinate agencies of entities subject to United Nations sanctions, such as the Reconnaissance General Bureau, Ministry of Atomic Energy Industry, and the Military Industry Department, and remit about half of their income to North Korea.

The report specifically states that the Cambodian financial platform "Huione" was used for laundering and cashing out the stolen virtual assets. It was found that a North Korean national based in Cambodia utilized a Huione Pay account to launder approximately 600 million dollars stolen in the March 2022 hacking of the Vietnamese company Axie Infinity. As a result, the U.S. Financial Crimes Enforcement Network (FinCEN) recently designated Huione Group, the parent company, as a "primary money laundering concern financial institution." Although the National Bank of Cambodia revoked Huione Pay's license, it continues to operate within Cambodia.

Meanwhile, this report is significant as it is the first comprehensive report to collect and present an overall picture of North Korea's previously fragmented illegal cyber activities. In particular, it provides a diagram mapping the relationships among North Korea's cyber organizations under the party, government, and military.

An official from the Ministry of Foreign Affairs stated, "This report is expected to draw international attention to the various violations of United Nations sanctions revealed through North Korea's theft and laundering of virtual assets and IT personnel activities, and to raise awareness about the methods and risks of North Korea's cyber activities."