North Korea is hacking bitcoin exchanges as currency value soars, expert says
As bitcoin’s value continues to surge, North Korean hackers are taking advantage by targeting exchanges to gain financial profit, experts said on Friday as sanctions against Kim Jong Un’s regime threaten to impede on economic development.
Bitcoin’s value has skyrocketed this year, especially in the last week when the volatile digital currency hit above $17,000 after the value see-sawed for a few hours. One bitcoin was worth less than $1,000 at the start of the year. The increasing price is not only attractive to investors, but to hackers working for the Hermit Kingdom, Ashley Shen, an independent security researcher, told Sky News.
“We assume one of the reasons why Bitcoin is being attacked is because the price keeps increasing and we think it’s reasonable for hackers [to target],” Shen told Sky News. “Digital currency might be easier to gain than physical currency. So I think it’s reasonable.”
Shen said she and other researchers have been tracking Lazarus, Bluenoroff and Andariel — hacking groups suspected of being backed by North Korea — and attacks done on banks in Europe and South Korea, an ATM company and bitcoin exchange. She told Sky News cyberattacks are usually conducted to gain confidential information, but they have been recently veered toward gaining digital currency.
“Before, when we tracked nation-state attackers, they usually perform cyberattacks which are aimed for confidential data and intelligence,” Shen said. “However, recently we’ve discovered that some of the APT [Advanced Persistent Threat] groups are trying to hack financial institutions like banks and Bitcoin exchanges to gain financial profit.”
The expert said the cyberattacks have been unsuccessful, but believes they will continue because bitcoin’s increasing value makes it “a good investment.”
She added, “So I assume they will do more Bitcoin attacks and of course they will keep targeting banks because that’s what they did before.”
A researcher who remained anonymous because she works for a South Korean bank also noted possible “financial difficulties” North Korea is facing because of the increase in hacks.
“Just a few years ago the attacks were initiated to paralyze the society, but for some time now they’ve been hacking for money — so I kind of wonder if they are facing financial difficulties,” the researcher said.
North Korea has faced tougher sanctions since it conducted its sixth nuclear test in September. The U.N. Security Council unanimously approved sanctions against North Korea after the test. The Trump administration then imposed new sanctions in late November on a slew of North Korean shipping firms and Chinese trading companies.
South Korea also announced on Sunday 20 North Korean organizations and 12 individuals that will be placed in its own sanctions blacklist — its response to Kim’s latest ICBM launch.
Security firm FireEye also revealed in a report in September that hackers linked to North Korea have stolen bitcoins from at least three South Korean cryptocurrency exchanges since May 2017.
“Now, we may be witnessing a second wave of this campaign: state-sponsored actors seeking to steal bitcoin and other virtual currencies as a means of evading sanctions and obtaining hard currencies to fund the regime,” the report stated.
The Associated Press contributed to this report.