North Korean hackers stole $400 million in cryptocurrency in 2021
According to Chainalysis, the cyber attacks were supported by the country's government
14.01.2022 - 12:30
769
1 min
0
What’s new? Chainalysis reported that the DPRK hackers stole about $395 million in 2021. The Lazarus cybercriminal group carried out more than 7 attacks on the investment firms and centralized stock exchanges.
What are the details of the cyber attacks? Chainalysis suggests that the hackers acted under the direction of North Korea's intelligence agency. The stolen cryptocurrencies consisted of 58% Ethereum, with bitcoins accounting for 20%. The remaining 22% included the ERC-20 tokens and altcoins. The report states:
“These attacks targeted primarily investment firms and centralized exchanges, and made use of phishing lures, code exploits, malware, and advanced social engineering to siphon funds out of these organizations’ internet-connected “hot” wallets into DPRK-controlled addresses.”
How does the DPRK launder cryptocurrency? The state uses multiple mixers to hide the traces of the hacked cryptocurrency and cash out, often using the DeFi platforms. Citing data from the UN Security Council, Chainalysis stated that North Korea is believed to own $170 million in stocks of untraceable cryptocurrencies.
Useful material?
Incidents
In a single week, hackers went after PHP websites, the Railway cloud platform and a medical company, and experts started talking about a crisis that is only just beginning.
Oct 28, 2026
Incidents
In 104 minutes, the attacker emptied 1,404 addresses before validators halted the network and froze almost all of the loot.
Oct 19, 2026
Incidents
Developers warned of potential risks to bridges across the ecosystem and asked exchanges for assistance.
Jun 22, 2026
Incidents
The defendant helped move funds stolen through investment scams and earned at least $4 million for his role in the operation.
Jun 10, 2026
Incidents
The company is linking the incident to a compromised private key on a service wallet, rather than a smart contract exploit
May 22, 2026
Incidents
Following the incident, the project temporarily halted trading operations and node activity.
May 15, 2026
Telegram
Twitter