How North Korea Cheated Its Way to Crypto Billions

It has swiped more than $6 billion in cryptocurrency over the past decade

- Patricia Kowsmann & Timothy W. Martin

At 11:49 a.m. on July 18, North Korean hackers pounced on a major cryptocurrency exchange handling hundreds of millions of dollars.

The hackers slipped into the exchange's virtual vault, took control and then started pilfering cryptocurrency tokens. Within a little more than an hour, the hackers had disappeared—and with them, more than $200 million for the Kim Jong Un regime.

The shocking theft at WazirX, India's largest cryptocurrency exchange, along with several other major recent heists, has made it clear: North Korea is now the world's most dangerous crypto thief.

It has swiped more than $6 billion in cryptocurrency over the past decade—a sum so large that no one else compares.

The country's hackers are both patient and brazen, according to investigators. To get into companies' computers, they comb through employees' Facebook and Instagram pages and invent tailor-made stories to trick them into clicking on links with viruses.

Some North Korean hackers have even become employees themselves, fooling U.S. companies into hiring them as remote IT workers and gaining access to their networks.

After grabbing their bounty, North Korean hackers are masters at escaping. At WazirX, investigators believe they used algorithms to spread funds through global crypto networks faster than any human could, making it almost impossible for authorities to catch up.

Once the crypto is dispersed, North Koreans often lie low until investigators lose interest and move on, waiting months or years to convert their haul into traditional money that can be spent.

"North Korean hackers are playing a different game than anyone else," said Nick Carlsen, a former Federal Bureau of Investigation analyst who is now an investigator at TRM Labs, a blockchain-analytics firm.