🕵️ North Korean hackers have become professional plunderers. Every year, North Korean hackers "withdraw" funds from the cryptocurrency industry. They have established a highly professional cyberattack infrastructure, consistently targeting global financial systems, enterprises, and government institutions to acquire funds and intelligence. In the early stages, North Korean hackers primarily focused on traditional financial systems. For instance, as far back as 2016, they infiltrated Bangladesh’s central bank and orchestrated fraudulent SWIFT transfers totaling approximately $951 million, successfully stealing $810 million. However, as the cryptocurrency industry has evolved, so too have the hackers’ targets. Recent high-profile thefts reveal that cryptocurrency exchanges, wallets, cross-chain bridges, and DeFi protocols have become key targets for their financial gains. Of the 28 major security incidents in the cryptocurrency industry that I have documented, 10 have been explicitly attributed—or assigned with high confidence by security agencies—to North Korean-linked hacking groups. More notably, I’ve observed that the methods and preferences of North Korean hackers are also shifting: they are no longer solely exploiting code vulnerabilities in smart contracts but are increasingly targeting people. North Korean operatives have even fabricated identities to directly apply for remote positions at cryptocurrency companies. Meanwhile, attackers impersonate recruiters, business partners, or investment firms, building long-term trust with teams before seizing opportunities to compromise employee devices, development environments, and critical signing processes.