South Korea sanctions North Korean hackers for crypto thefts

South Korea has recently taken a stand against North Korean cyberattacks and crypto thefts with the announcement of its inaugural independent sanctions. Seoul’s Ministry of Foreign Affairs revealed that seven businesses and four notorious individuals—Park Jin-hyok, Jo Myong-rae, Song Rim, and Oh Chung-Seong—have all been placed on the blacklist for suspected involvement in illegal cryptocurrency activities.

Park is the most infamous of all four hackers, currently employed in IT for Chosun Expo Joint Venture— a front company tied to Lazarus Group from North Korea. He became widely recognized for his involvement with the WannaCry ransomware attack and the Sony Pictures Entertainment cyberattack in 2014. Consequently, United States Treasury included him on its blacklist in 2018.

The foreign ministry has indicated that North Korean hackers have stolen more than $1.2 billion in virtual assets since 2017, with a staggering $626 million in 2022 alone. It is essential to know that an undisclosed U.N. document stated that the hacking activity this year surpassed all other years – accumulating between $650 and $1 billion. Unquestionably, these malicious activities caused significant damage to economies around the world and demonstrated how vulnerable digital currency is against cybercrimes.

In a swift response, independent sanctions were imposed against North Korean hackers and hacking groups only hours after South Korea and the US announced their joint cybersecurity initiative to tackle ransomware. A collaborative effort between the National Intelligence Service of South Korea and other U.S. intelligence organizations, including the National Security Agency, culminated in an urgent warning about potential attacks from North Korean-based cybercriminals being circulated among all major stakeholders.

Despite being under the strictest of international sanctions, North Korea’s Reconnaissance General Bureau—its military intelligence agency—has been closely linked to numerous cyber activities that are believed to serve as a major source for their nuclear and missile programs’ funding.