FBI-wanted N. Korean hacker back in spotlight

A North Korean programmer accused of helping orchestrate some of the world's most disruptive cyberattacks is back in the spotlight.

Park Jin-hyok has drawn renewed attention after the FBI attributed the Oct. 29 theft of approximately $6.3 billion in cryptocurrency from Binance to a North Korean cyber operation known as TraderTraitor.

Though US authorities have not identified Park as a suspect in the latest breach, his alleged involvement in earlier attacks offers a window into how North Korea's cyber capabilities have developed over the past decade.

Park, a suspected member of the notorious North Korean hacking group Lazarus, has been on the FBI's wanted list for more than eight years.

He has been accused of participating in cyberattacks ranging from the 2014 Sony Pictures breach to the theft of millions of dollars from Bangladesh's central bank. According to the FBI's public wanted notice, he is believed to have been born in either 1981 or 1984 and has operated under several aliases, including Jin-hyok Park, Pak Jin-hek and Pak Kwang-jin.

A federal arrest warrant was issued for him in June 2018, followed by the unsealing of a criminal complaint by the US Justice Department that September.

US investigators identified Park as a computer programmer associated with a North Korean state-sponsored hacking conspiracy linked to the Reconnaissance General Bureau, the country's military intelligence agency. The network has been associated with Lazarus Group and APT38, names used by cybersecurity researchers to track different aspects of North Korea's cyber operations.

Park reportedly spent more than a decade working for Chosun Expo Joint Venture, a software development company with operations in North Korea and China, including the northeastern Chinese city of Dalian.

Although the company presented itself as a legitimate technology business serving international clients, US prosecutors alleged that it functioned as a front for North Korean intelligence operations, combining commercial software development with clandestine hacking activities.

The allegations against Park trace back to a period when North Korea's cyber operations were drawing international attention primarily for their disruptive and politically motivated nature.

In 2014, hackers infiltrated Sony Pictures Entertainment ahead of the release of "The Interview," a Hollywood comedy depicting the assassination of North Korean leader Kim Jong-un.

The attackers stole confidential corporate information, leaked employees' personal data and damaged thousands of computers, disrupting the company's operations.

US authorities attributed the attack to North Korea and alleged that Park participated in the operation, which investigators characterized as retaliation for the film.

Two years later, the alleged hacking network was implicated in a markedly different operation: an attempt to steal nearly $1 billion from Bangladesh's central bank.

In February 2016, hackers compromised the bank's systems and used the SWIFT international financial messaging network to issue fraudulent transfer instructions to the Federal Reserve Bank of New York.

Although security checks and other irregularities prevented most of the attempted transfers, the attackers succeeded in stealing approximately $81 million.

The operation demonstrated how cyber intrusions could be used not only to disrupt foreign targets but also to generate substantial financial gains.

Park was subsequently linked to the 2017 WannaCry ransomware outbreak, which infected computers across the globe, disrupting businesses, hospitals and public institutions, including Britain's National Health Service.

The malware encrypted files on infected systems and demanded payments for their recovery, illustrating the potentially widespread consequences of malicious software deployed through interconnected computer networks.

US investigators also accused Park and his associates of attempting to compromise American defense contractor Lockheed Martin through malicious emails, although the effort reportedly failed.

The scope of the alleged conspiracy became clearer in February 2021, when the Justice Department unsealed an indictment naming Park alongside two other North Korean programmers, Jon Chang-hyok and Kim Il.

Prosecutors accused the three of participating in a global campaign to steal or extort more than $1.3 billion from financial institutions, businesses and cryptocurrency platforms.

The indictment also detailed the use of malicious cryptocurrency applications designed to give attackers unauthorized access to victims' computers, underscoring the growing importance of digital assets in North Korea's alleged cybercrime operations.

The latest Binance incident has again raised questions about the scale and sophistication of those operations.

In the recent Binance heist, the FBI said North Korean hackers converted much of the stolen cryptocurrency into ether in an apparent effort to move the illicit proceeds.

The agency urged cryptocurrency exchanges and other service providers to identify and block transactions involving wallets associated with the stolen funds.

The sheer scale of the alleged theft has intensified scrutiny of North Korea's cyber capabilities, particularly amid longstanding international concerns that illicit cryptocurrency proceeds could help finance the country's weapons programs and circumvent economic sanctions.

North Korea has rejected the allegations.

In a statement carried by the Korean Central News Agency on Nov. 3, Kim Yo-jong, sister of North Korean leader Kim Jong-un, denounced the FBI's findings as a politically motivated accusation aimed at portraying Pyongyang as a cybercriminal state.

She accused Washington of attempting to associate North Korea with international cybercrime and warned that continued US hostility could affect Pyongyang's approach toward relations with Washington.

Despite renewed attention surrounding Park, the FBI's latest attribution does not establish his involvement in the Binance breach, and no publicly disclosed evidence directly connects him to the incident.

Nevertheless, the allegations spanning his years on the FBI's wanted list illustrate the breadth of cyber operations US authorities have attributed to North Korea — from attacks intended to intimidate and disrupt foreign targets to increasingly ambitious efforts to extract money from the global financial system.

Park remains wanted by US authorities, with the criminal charges against him unresolved.