North Korean hackers have stolen billions of dollars by infiltrating cryptocurrency exchanges and creating fake identities to secure remote tech jobs abroad, according to a new international report exposing the secretive nation’s growing cyber empire.
The 138-page assessment, released by the Multilateral Sanctions Monitoring Team — a coalition of 11 countries including the U.S., U.K., Japan, and South Korea — reveals how Pyongyang has weaponized cybercrime to fund its nuclear and missile programs. The group was formed last year after Russia vetoed a United Nations Security Council resolution that would have extended the mandate of the U.N. panel monitoring North Korea’s sanctions compliance.
Financing Weapons Through Cybercrime
The report concludes that officials in Pyongyang are directing covert cyber operations to finance research and development for nuclear weapons. Hackers under the regime’s control have been accused of stealing digital assets, laundering cryptocurrency, and even using fake job identities to funnel money back to North Korea’s military programs.
According to investigators, these activities have allowed the isolated nation to circumvent international sanctions while continuing to invest heavily in offensive cyber capabilities.
A Global Threat in the Digital Era
Despite its size and economic isolation, North Korea’s hacking prowess now rivals that of China and Russia, the report notes. It says the country’s cyber forces pose a significant threat to governments, corporations, and individuals across the world. Unlike other nations known for state-sponsored hacking — such as Iran, Russia, or China — North Korea’s operations are largely financially motivated, aimed at sustaining its regime and weapons programs.
The report states that, aided by allies in Moscow and Beijing, North Korea’s cyber actions have “been directly linked to the destruction of physical computer equipment, endangerment of human lives, private citizens’ loss of assets and property, and funding for the DPRK’s unlawful weapons of mass destruction and ballistic missile programs.”
The Mechanics of the Heists
One of the most striking findings involves the regime’s growing reliance on cryptocurrency theft and laundering schemes. Earlier this year, hackers linked to North Korea pulled off one of the largest crypto heists in history, stealing $1.5 billion worth of Ethereum from the exchange Bybit. The FBI later tied the operation to cyber units working under North Korea’s intelligence agency.
The country’s hackers have also deployed malware designed to disrupt global networks and extract sensitive data from foreign businesses and organizations. These cyberattacks are not only aimed at financial theft but also serve as a method of espionage and technological acquisition, helping North Korea evade trade restrictions.
The Fake Worker Operation
Federal authorities in the U.S. have also revealed that thousands of “remote” IT workers employed by Western companies may have been North Koreans using stolen or fabricated identities. These operatives allegedly gained access to internal systems and diverted their earnings directly to the regime.
In some cases, the report says, individuals held multiple remote jobs simultaneously, amplifying the financial flow to Pyongyang.
Expanding Cyber Reach
The monitoring team’s findings underscore how North Korea has transformed hacking into a state-funded industry, blending espionage with organized crime. The profits from these cyber operations, investigators warn, are being funneled into weapons development, missile testing, and nuclear research, allowing Pyongyang to bypass traditional economic pressure.
The group’s latest report follows its first publication in May, which examined North Korea’s military support for Russia amid the war in Ukraine. Together, the reports paint a picture of a regime increasingly reliant on cyber warfare as both a diplomatic tool and a financial lifeline.
As the digital frontlines expand, experts warn that North Korea’s cyber playbook may become a model for other sanctioned states — demonstrating how hacking, deception, and digital theft can power an isolated nation’s survival in the modern world.
