North Korea Is Targeting South Korea's Bitcoin Exchanges, Report Claims
Actors tied to the isolated nation have been involved in attacks on crypto exchanges in South Korea, a prominent U.S.cybersecurity firm said.

North Korea, a pariah state widely believed to have been behind cyberattacks on financial institutions around the world, may also have tried to pilfer cryptocurrencies to get around sanctions.
Actors tied to the isolated nation have been involved in attacks on cryptocurrency exchanges in South Korea, FireEye, a prominent cybersecurity firm, said in a report today.
"Since May 2017, we have observed North Korean actors target at least three South Korean cryptocurrency exchanges with the suspected intent of stealing funds," Luke McNamara, a senior cyber threat intelligence analyst at FireEye, wrote in a blog post published Monday. "The spearphishing we have observed in these cases often targets personal email accounts of employees at digital currency exchanges, frequently using tax-themed lures and deploying malware ... linked to North Korean actors suspected to be responsible for intrusions into global banks in 2016."
The claims come at a time when the communist nation's relations with the international community – never all that warm – have been particularly frosty.
On Tuesday, the UN Security Council unanimously approved new sanctions against North Korea a week after it conducted its sixth and largest nuclear test to date.
McNamara's post did not identify the three exchanges allegedly targeted or give any indication that the theft attempts were successful. An incident in April, in which wallets at the South Korean exchange Yapizon were compromised, cannot be clearly tied to North Korean actors, he wrote.
Cryptocurrency may be an appealing way for Pyongyang to skirt international financial controls, suggested McNamara, who is based in the Washington, D.C., area.
"If actors compromise an exchange itself (as opposed to an individual account or wallet) they potentially can move cryptocurrencies out of online wallets, swapping them for other, more anonymous cryptocurrencies or send them directly to other wallets on different exchanges to withdraw them in fiat currencies such as South Korean won, US dollars, or Chinese renminbi," McNamara wrote, adding:
"As the regulatory environment around cryptocurrencies is still emerging, some exchanges in different jurisdictions may have lax anti-money laundering controls easing this process and make the exchanges an attractive tactic for anyone seeking hard currency."
The Permanent Mission to the United Nations of the Democratic People's Republic of Korea did not immediately respond to a request for comment.
North Korea image by Shutterstock.
More For You
Protocol Research: GoPlus Security

What to know:
- As of October 2025, GoPlus has generated $4.7M in total revenue across its product lines. The GoPlus App is the primary revenue driver, contributing $2.5M (approx. 53%), followed by the SafeToken Protocol at $1.7M.
- GoPlus Intelligence's Token Security API averaged 717 million monthly calls year-to-date in 2025 , with a peak of nearly 1 billion calls in February 2025. Total blockchain-level requests, including transaction simulations, averaged an additional 350 million per month.
- Since its January 2025 launch , the $GPS token has registered over $5B in total spot volume and $10B in derivatives volume in 2025. Monthly spot volume peaked in March 2025 at over $1.1B , while derivatives volume peaked the same month at over $4B.
More For You
U.S. Interest Rates, Do Kwon Sentencing: Crypto Week Ahead

Your look at what's coming in the week starting Dec. 8.
What to know:
You are reading Crypto Week Ahead: a comprehensive list of what's coming up in the world of cryptocurrencies and blockchain in the coming days, as well as the major macroeconomic events that will influence digital asset markets. For an updated daily email reminder of what's expected, click here to sign up for Crypto Daybook Americas. You won't want to start your day without it.











