Cyber actors from Democratic People's Republic of Korea (DPRK) stole $659 million in cryptocurrency in 2024, according to a recently released joint statement by the US, Japan, and South Korea. 

The report identified five heists, including a $235 million theft from Indian crypto exchange WazirX, linked to the Lazarus Group, alleged as a North Korea sponsored organisation. Lazarus has been implicated in numerous high-profile cyber attacks over the past decade, including stealing $625 million from Axie Infinity in 2022.

The largest theft of 2024 targeted Japan's DMM Bitcoin, resulting in a $308 million loss that ultimately forced the exchange to shut down. The statement noted a continued pattern of North Korea aggressively targeting the cryptocurrency sector, employing sophisticated social engineering tactics to deploy malware like TraderTraitor and AppleJeus.

The United States, South Korea, and Japan warned that these attacks often involve personalised phishing attempts. Hackers use elaborate scenarios to deceive victims, including fake job offers and business opportunities, leveraging detailed information and imagery extracted from social media accounts.

A September 2024 FBI warning highlighted the risks of inadvertently hiring North Korean IT workers, urging businesses to take precautions against infiltration. Similar alerts from Japan and South Korea emphasised the need for vigilance as hackers increasingly exploit trusted contacts and impersonate prominent individuals within the cryptocurrency industry.