[Editorial] NK's cyber arsenal

The US Federal Bureau of Investigation has blamed North Korea for hacking cryptocurrency exchange Binance and stealing digital assets worth $6.3 billion.

It took just 20 minutes to siphon off the staggering sum, the largest haul ever reported in a cryptocurrency hack. North Korea’s cyber capabilities have reached an alarming level, enabling it to breach the defenses of the world’s largest cryptocurrency exchange and make off in minutes with an amount equivalent to roughly one-fifth of its gross national income.

North Korea has expanded its illicit sources of foreign currency, moving from counterfeiting in the 1990s to drug trafficking in the 2000s and cybertheft in recent years. It is increasingly focused on cryptocurrency theft, which allows funds to move easily across borders and makes money laundering difficult to trace.

The stolen funds are particularly troubling for South Korea because they help finance the North’s weapons programs. In a 2024 report, the UN Security Council’s Panel of Experts on North Korea sanctions said illicit cyber activities provided 40 percent of the funding for the North’s weapons of mass destruction programs. A US blockchain analytics firm estimates that North Korea-linked hacking groups accounted for about 60 percent of all cryptocurrency stolen worldwide last year.

Beyond threatening the security of international financial transactions, hacking has become a clandestine revenue stream for North Korea. If Pyongyang can secure its foreign currency so easily through cybercrime, it has little incentive to bargain away its nuclear arsenal in exchange for sanctions relief.

The threat is not confined to international cryptocurrency markets. In 2024, South Korean police attributed the theft of about 58 billion won worth of cyber money ($43 million) from Upbit in 2019 to a North Korean hacking group. Reports have also said that authorities detected 4.4 million attempts to access South Korean financial institutions using IP addresses assigned to North Korea. The reported volume of these attempts points to a sustained effort to probe vulnerabilities across South Korea’s financial system.

North Korean hacking groups pursue two objectives: stealing assets and gathering intelligence. As their capabilities grow, cyberespionage targeting South Korea’s defense, foreign affairs and intelligence agencies is bound to intensify. More alarming still is the prospect that artificial intelligence could further enhance the North’s ability to launch cyberattacks.

North Korea’s cybercrime proceeds are likely to fund weapons development, from nuclear arms to drones. On Oct. 29, the North Korean military showcased an array of new drones, including large stealth models and drones designed to attack tanks and heavily armored vehicles. The North is also approaching the capacity to produce 10 to 20 nuclear warheads a year and developing the means to strike the US mainland with nuclear submarines and intercontinental ballistic missiles.

North Korea’s hacking operations go beyond financial theft. It has repeatedly sought opportunities to penetrate South Korea’s military command and communications networks. In a conflict, an attack on critical infrastructure — including airports, railways, seaports, and power, communications and water supply networks — could cause catastrophic damage.

The government must treat North Korean cyberattacks as a major national security threat and overhaul its response framework, bringing together relevant ministries, intelligence and law enforcement agencies, and the private sector. It should audit the security systems of financial institutions and cryptocurrency exchanges and strengthen employees’ security awareness. Equally urgent is the need to deploy AI-powered detection and defense systems to counter attacks that exploit the technology.

International cooperation is essential, too. South Korea should expand intelligence sharing with law enforcement and intelligence agencies in the United States and other major countries, while strengthening its ability to trace suspicious transactions.

North Korea is building its cyberattack capabilities at the state level. South Korea must build up its own commensurate defense.