North Korea steals $1.7B in crypto heists
North Korean state hackers stole $1.7 billion in cryptocurrency in 2022 to fund weapons programs, exploiting DeFi protocol vulnerabilities in 82% of all crypto thefts.
North Korean state-linked hackers, including the Lazarus Group, stole approximately $1.7 billion worth of cryptocurrency in 2022 out of $3.8 billion stolen globally, according to blockchain analysis firm Chainalysis. The FBI attributes multiple high-profile thefts to North Korean actors using the proceeds to fund the country's nuclear and missile programs. DeFi protocols accounted for 82.1 percent of all cryptocurrency stolen in 2022, totaling $3.1 billion, with cross-chain bridges being particularly vulnerable targets. A January 2023 operation by South Korean intelligence and US investigators successfully interdicted $100 million stolen from Harmony, a US-based cryptocurrency company, after a seven-month investigation.
Russia-based actors remain equally active in cryptocurrency crime, with Moscow-based exchanges Bitzlato and Garantex designated for laundering hundreds of millions of dollars for darknet markets and ransomware actors. Iran, Russia, and North Korea are leveraging cryptocurrency vulnerabilities both to generate revenue and evade sanctions. Cybersecurity experts note that most attacks exploit relatively mundane smart contract vulnerabilities rather than sophisticated new techniques, with endpoint security and credential theft posing significant risks to users.
The maturation of blockchain analytics has made it harder for threat actors to move stolen funds undetected, with some hackers leaving funds dormant to avoid detection. The US government has responded through law enforcement actions, sanctions, asset seizures, and darknet market takedowns including Hydra Market and Genesis Market. Experts recommend increased international collaboration, enhanced smart contract security standards, and continued development of blockchain forensics capabilities to address the growing threat landscape.
Mentioned in this report
Detection guidance
Cryptocurrency Wallet File Access or Copy Attempt
Detects processes reading, copying, or moving common cryptocurrency wallet/private-key files, consistent with credential theft preceding crypto-heist operations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cryptocurrency Wallet File Access or Copy Attempt
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- wallet.dat
- .wallet
- wallet.json
- keystore
- UTC--20
- electrum.dat
- metamask
filter_known_apps:
Image|endswith:
- \bitcoin-qt.exe
- \electrum.exe
- \exodus.exe
- \metamask
condition: selection and not filter_known_apps
falsepositives:
- Legitimate wallet application startup or backup by the user
- Endpoint backup/sync tools indexing user profile folders
level: medium
tags:
- attack.t1552.004
- attack.credential_access
id: e4aa309e-d1ac-5c7b-844d-5c43324a4167
status: experimental
author: Vorant
Archival or Compression of Cryptocurrency Wallet Directories
Detects use of archive/compression utilities referencing wallet or keystore paths, suggesting staging of private key material for exfiltration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Archival or Compression of Cryptocurrency Wallet Directories
logsource:
category: process_creation
product: windows
detection:
selection_tool:
Image|endswith:
- \7z.exe
- \winrar.exe
- \rar.exe
- \tar.exe
selection_target:
CommandLine|contains:
- wallet
- keystore
- electrum
- metamask
condition: selection_tool and selection_target
falsepositives:
- IT staff archiving user profile directories for backup or migration purposes
- Wallet software vendor support tools packaging diagnostic data
level: medium
tags:
- attack.t1552.004
- attack.credential_access
id: 5a5bd255-cc2f-5b74-864e-ffbc132b0052
status: experimental
author: Vorant
Shadow Copy and Backup Deletion Prior to Data Encryption
Detects deletion of volume shadow copies and backup catalogs, a common precursor step used by ransomware/data-destruction actors to prevent recovery before encrypting data for impact. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shadow Copy and Backup Deletion Prior to Data Encryption
logsource:
category: process_creation
product: windows
detection:
selection_vssadmin:
Image|endswith: \vssadmin.exe
CommandLine|contains:
- delete shadows
- resize shadowstorage
selection_wbadmin:
Image|endswith: \wbadmin.exe
CommandLine|contains: delete catalog
selection_bcdedit:
Image|endswith: \bcdedit.exe
CommandLine|contains:
- recoveryenabled no
- bootstatuspolicy ignoreallfailures
condition: 1 of selection_*
falsepositives:
- Authorized backup maintenance or disk cleanup scripts
- System administrators disabling recovery options during imaging or migration
level: high
tags:
- attack.t1486
- attack.impact
id: c602329a-9a16-5d45-953f-f7e8c4dfe316
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.atlanticcouncil.org/content-series/the-5x5/the-5x5-cryptocurrency-hackings-geopolitical-and-cyber-implications
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free