South Korea takes the brunt of North Korea’s cryptocurrency cyberattacks

A United Nations (UN) report has disclosed how the intergovernmental organization is investigating at least 35 cyberattacks led by North Korea, South China Morning Post reports.

The attacks include cryptocurrency exchange hacks and crypto-jacking campaigns.

South Korea was the most affected being victim to 10 attacks from its northern neighbor. India witnessed three attacks, Bangladesh and Chile both experienced two each.

A further 13 countries including Kuwait, Nigeria, Poland, and South Africa were all affected once.

North Korea executes three types of attack

One attack targets the international payment system, SWIFT. The other two focus on obtaining cryptocurrency, either by hacking exchanges or individuals and stealing their coins, or through crypto-jacking.

North Korean hackers have also been sneaking mining scripts onto foreign computers to surreptitiously mine cryptocurrency for some time. South Korea has been one of the country’s main targets in such campaigns and this report only further confirms the fact.

UN experts made a point of emphasizing that these kinds of attacks are “low risk and high yield,” requiring few resources to enact. One would assume it’s likely the attacks will continue to happen unless authorities intervene.

UN investigators said South Korean cryptocurrency exchange, Bithumb, has been hacked at least four times. The first two attacks (in 2017) each resulted in losses of around $7 million, while the second two attacks (in June 2018 and March 2019) leading to the loss of $31 million and $20 million, respectively.

In particular, the UN’s report highlighted a crypto-jacking incident in which North Korean hackers are thought to have hijacked South Korean computers to mine Monero and redirect funds to servers at a university in Pyongyang.

It’s believed the cyberattacks were used to fund North Korea’s weapons program. Estimates suggest the country has amassed some $2 billion through these nefarious tactics.

The reported attacks are being investigated and considered as attempts to violate UN sanctions.