# North Korea steals $1.7B in crypto heists

Published: 2023-05-03 · Severity: high · Sectors: financial-services
Canonical: https://vorant.io/reports/146ffcbf-fe5a-5e56-8159-ea411373ccf2/north-korea-steals-1-7b-in-crypto-heists

> North Korean state hackers stole $1.7 billion in cryptocurrency in 2022 to fund weapons programs, exploiting DeFi protocol vulnerabilities in 82% of all crypto thefts.

North Korean state-linked hackers, including the Lazarus Group, stole approximately $1.7 billion worth of cryptocurrency in 2022 out of $3.8 billion stolen globally, according to blockchain analysis firm Chainalysis. The FBI attributes multiple high-profile thefts to North Korean actors using the proceeds to fund the country's nuclear and missile programs. DeFi protocols accounted for 82.1 percent of all cryptocurrency stolen in 2022, totaling $3.1 billion, with cross-chain bridges being particularly vulnerable targets. A January 2023 operation by South Korean intelligence and US investigators successfully interdicted $100 million stolen from Harmony, a US-based cryptocurrency company, after a seven-month investigation.

Russia-based actors remain equally active in cryptocurrency crime, with Moscow-based exchanges Bitzlato and Garantex designated for laundering hundreds of millions of dollars for darknet markets and ransomware actors. Iran, Russia, and North Korea are leveraging cryptocurrency vulnerabilities both to generate revenue and evade sanctions. Cybersecurity experts note that most attacks exploit relatively mundane smart contract vulnerabilities rather than sophisticated new techniques, with endpoint security and credential theft posing significant risks to users.

The maturation of blockchain analytics has made it harder for threat actors to move stolen funds undetected, with some hackers leaving funds dormant to avoid detection. The US government has responded through law enforcement actions, sanctions, asset seizures, and darknet market takedowns including Hydra Market and Genesis Market. Experts recommend increased international collaboration, enhanced smart contract security standards, and continued development of blockchain forensics capabilities to address the growing threat landscape.

## Mentioned in this report

- Threat actors: Lazarus Group
- Malware: Glupteba

## Detection guidance (public sample)

### Cryptocurrency Wallet File Access or Copy Attempt

ATT&CK: T1552.004

Detects processes reading, copying, or moving common cryptocurrency wallet/private-key files, consistent with credential theft preceding crypto-heist operations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cryptocurrency Wallet File Access or Copy Attempt
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - wallet.dat
    - .wallet
    - wallet.json
    - keystore
    - UTC--20
    - electrum.dat
    - metamask
  filter_known_apps:
    Image|endswith:
    - \bitcoin-qt.exe
    - \electrum.exe
    - \exodus.exe
    - \metamask
  condition: selection and not filter_known_apps
falsepositives:
- Legitimate wallet application startup or backup by the user
- Endpoint backup/sync tools indexing user profile folders
level: medium
tags:
- attack.t1552.004
- attack.credential_access
id: e4aa309e-d1ac-5c7b-844d-5c43324a4167
status: experimental
author: Vorant
```

### Archival or Compression of Cryptocurrency Wallet Directories

ATT&CK: T1552.004

Detects use of archive/compression utilities referencing wallet or keystore paths, suggesting staging of private key material for exfiltration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Archival or Compression of Cryptocurrency Wallet Directories
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
    - \7z.exe
    - \winrar.exe
    - \rar.exe
    - \tar.exe
  selection_target:
    CommandLine|contains:
    - wallet
    - keystore
    - electrum
    - metamask
  condition: selection_tool and selection_target
falsepositives:
- IT staff archiving user profile directories for backup or migration purposes
- Wallet software vendor support tools packaging diagnostic data
level: medium
tags:
- attack.t1552.004
- attack.credential_access
id: 5a5bd255-cc2f-5b74-864e-ffbc132b0052
status: experimental
author: Vorant
```

### Shadow Copy and Backup Deletion Prior to Data Encryption

ATT&CK: T1486

Detects deletion of volume shadow copies and backup catalogs, a common precursor step used by ransomware/data-destruction actors to prevent recovery before encrypting data for impact. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shadow Copy and Backup Deletion Prior to Data Encryption
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: \vssadmin.exe
    CommandLine|contains:
    - delete shadows
    - resize shadowstorage
  selection_wbadmin:
    Image|endswith: \wbadmin.exe
    CommandLine|contains: delete catalog
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains:
    - recoveryenabled no
    - bootstatuspolicy ignoreallfailures
  condition: 1 of selection_*
falsepositives:
- Authorized backup maintenance or disk cleanup scripts
- System administrators disabling recovery options during imaging or migration
level: high
tags:
- attack.t1486
- attack.impact
id: c602329a-9a16-5d45-953f-f7e8c4dfe316
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.atlanticcouncil.org/content-series/the-5x5/the-5x5-cryptocurrency-hackings-geopolitical-and-cyber-implications

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/146ffcbf-fe5a-5e56-8159-ea411373ccf2/north-korea-steals-1-7b-in-crypto-heists.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup