What is North Korea?

North Korea converted nearly all of $1.5 billion in stolen Ethereum from the Bybit hack into other assets within the first 72 hours.

“Essentially, North Korea stole 1.5 billion in Ethereum. And within the first 72 hours, converted almost all of that And then started using the services that North Korea typically uses.”

A researcher embedded in DPRK systems for 22 months observed operations touching 1,600 companies across 57 countries.

“He was he was in these systems for something like 22 months just watching them do their you know, 1,600 companies, 57 countries are impacted.”

DPRK hackers were found inside major enterprises including Aon, Oppo, Coinbase, Uniswap Labs, and Italy's Supreme Judicial Council, contradicting the assumption that their campaigns mostly hit small to medium targets.

“I've always just thought that the other stuff going on is probably a long tail of small to medium actors on small to But these are big names that they were found in this research set like Aon Smart Technologies, Chinese phone manufacturer Oppo, crypto currency firms like Coinbase, Uniswap Labs, Italy Supreme Judicial Council.”

Chinese criminal networks share wallet addresses across cartel, North Korean, and pig-butchering operations, revealing a single consolidated laundering infrastructure serving multiple threat actors.

“If you look on chain at cartel activity, North Korea hacks, and these pig butchering networks, you see wallet addresses that are being used in all three of those laundering typologies or th- those threat categories, that we associate with Chinese money laundering networks.”

North Korean operatives meet protocol employees face-to-face at conferences over months to gain access, contradicting the assumption they operate purely through remote intrusion.

“North Korean proxies sitting across a table from protocol employees over a period of months.”

After the Bybit hack, North Korea laundered funds faster and with more liquidity access than ever before, attributed not to internal capability gains but to Chinese criminal networks.

“We saw North Korea move faster than ever before. It was clear to us that they had more access to liquidity than ever before. And I think that's a result of these Chinese criminal networks that are laundering the funds.”

North Korea's Lazarus group is not merely sharing tools with ransomware crews but operating as a unified team, evidenced by identical malware filenames, execution arguments, and SSH keys.

“That's not sharing at all. That's literally like sitting down together working as a team.”

Sarah Paine describes sanctions as economic chemotherapy, arguing even leaky ones suppress growth enough to explain the North/South Korea divergence.

“Sanctions are like economic chemotherapy. What you're doing is presenting pre preventing one or two percent growth per animal even with leaky sanctions, right? Well, and you go, 'So what?' Well, oh no. So very what is the difference over several generations is the difference between North and South Korea.”

Ari Redbord on North Korean cyber tactics shifting from systems to people.

“What we've really moved from is sort of just going after the technology to going after the people and it's really social engineering at scale.”

Even leaky sanctions that trim only 1 to 2 percent annual growth compound across generations to produce the vast development gap visible between North and South Korea.

“Sanctions are like economic chemotherapy. What you're doing is presenting pre preventing one or two percent growth per animal even with leaky sanctions, right? Well, and you go, 'So what?' Well, oh no. So very what is the difference over several generations is the difference between North and South Korea.”