South Korea sanctions DPRK hackers behind crypto attacks

South Korea has imposed new sanctions on North Korean hackers responsible for stealing over $1 billion in cryptocurrency with illicit funds fueling the regime’s weapons programs.

The South Korean government has announced sanctions against the 313 Bureau, a North Korean cyber unit involved in widespread crypto theft. In a press release on December 26, the government stated that the bureau, which operates under the North Korean Ministry of National Defense, has been linked to numerous cyber attacks aimed at stealing digital assets from around the world.

South Korean officials cite data from US blockchain analysis firm Chainalysis, which claims that North Korea is responsible for more than 60% of global crypto theft in 2024, totaling a record $1.3 billion. These stolen funds are believed to have been funneled into North Korea’s weapons programs, including missile and nuclear development initiatives.

In addition to targeting the 313 Bureau, the sanctions also cover 15 North Korean IT personnel and a related agency. The South Korean government says these individuals and organizations are accused of engaging in foreign exchange-earning activities abroad that directly contribute to the regime’s nuclear and missile programs.

“In particular, North Korean IT personnel working for the Ministry of National Defense and other regime-affiliated organizations are sent to countries in China, Russia, Southeast Asia and Africa.”

South Korean Ministry of Foreign Affairs

The move comes just three days after crypto.news reported that the United States and South Korea were working together to create new mechanisms to prevent crypto thefts linked to North Korea.

The two countries have reportedly signed an agreement to create joint technologies to stop crypto thefts. While details remain unclear, South Korea’s science ministry will also support the initiative until 2026. It appears that researchers from both countries, including experts from Korea University and RAND Corp., will focus on tracking stolen crypto and preventing attacks. They will also investigate how criminals transfer stolen funds into crypto using methods such as ransomware.