North Korea is hacking bitcoin exchanges as currency value soars, expert says

As bitcoin’s value continues to surge, North Korean hackers are taking advantage by targeting exchanges to gain financial profit, experts said on Friday as sanctions against Kim Jong Un's regime threaten to impede on economic development.

Bitcoin’s value has skyrocketed this year, especially in the last week when the volatile digital currency hit above $17,000 after the value see-sawed for a few hours. One bitcoin was worth less than $1,000 at the start of the year. The increasing price is not only attractive to investors, but to hackers working for the Hermit Kingdom, Ashley Shen, an independent security researcher, told Sky News.

FILE - In this Monday, April 7, 2014, file photo, a bitcoin logo is displayed at the Inside Bitcoins conference and trade show in New York. The bitcoin miner NiceHash says it is investigating a security breach and the theft of the contents of the NiceHash "bitcoin wallet." The company said Thursday, Dec. 7, 2017 in a statement posted on its website that it had stopped operations and was working to verify how many bitcoins were taken. (AP Photo/Mark Lennihan, File)

Bitcoin's value has skyrocketed this year. One bitcoin was worth less than $1,000 at the start of the year. It topped to $17,000 late Thursday.  (Copyright 2017 The Associated Press. All rights reserved.)

"We assume one of the reasons why Bitcoin is being attacked is because the price keeps increasing and we think it's reasonable for hackers [to target],” Shen told Sky News. "Digital currency might be easier to gain than physical currency. So I think it's reasonable."

Shen said she and other researchers have been tracking Lazarus, Bluenoroff and Andariel — hacking groups suspected of being backed by North Korea — and attacks done on banks in Europe and South Korea, an ATM company and bitcoin exchange. She told Sky News cyberattacks are usually conducted to gain confidential information, but they have been recently veered toward gaining digital currency.


"Before, when we tracked nation-state attackers, they usually perform cyberattacks which are aimed for confidential data and intelligence,” Shen said. "However, recently we've discovered that some of the APT [Advanced Persistent Threat] groups are trying to hack financial institutions like banks and Bitcoin exchanges to gain financial profit."

The expert said the cyberattacks have been unsuccessful, but believes they will continue because bitcoin’s increasing value makes it “a good investment.”

She added, “So I assume they will do more Bitcoin attacks and of course they will keep targeting banks because that's what they did before.”

A researcher who remained anonymous because she works for a South Korean bank also noted possible “financial difficulties” North Korea is facing because of the increase in hacks.

North Korea's leader Kim Jong Un is seen as the newly developed intercontinental ballistic rocket Hwasong-15's test was successfully launched, in this undated photo released by North Korea's Korean Central News Agency (KCNA) in Pyongyang November 30, 2017. REUTERS/KCNA ATTENTION EDITORS - THIS IMAGE WAS PROVIDED BY A THIRD PARTY. REUTERS IS UNABLE TO INDEPENDENTLY VERIFY THIS IMAGE. SOUTH KOREA OUT. NO THIRD PARTY SALES. NOT FOR USE BY REUTERS THIRD PARTY DISTRIBUTORS     TPX IMAGES OF THE DAY - RC13967A88D0

Kim Jong Un focused on developing North Korea's nuclear and missile program this year, but faced tougher sanctions because of it.  (KCNA via Reuters)

"Just a few years ago the attacks were initiated to paralyze the society, but for some time now they've been hacking for money — so I kind of wonder if they are facing financial difficulties,” the researcher said.


North Korea has faced tougher sanctions since it conducted its sixth nuclear test in September. The U.N. Security Council unanimously approved sanctions against North Korea after the test. The Trump administration then imposed new sanctions in late November on a slew of North Korean shipping firms and Chinese trading companies.

South Korea also announced on Sunday 20 North Korean organizations and 12 individuals that will be placed in its own sanctions blacklist — its response to Kim’s latest ICBM launch.

Security firm FireEye also revealed in a report in September that hackers linked to North Korea have stolen bitcoins from at least three South Korean cryptocurrency exchanges since May 2017.

“Now, we may be witnessing a second wave of this campaign: state-sponsored actors seeking to steal bitcoin and other virtual currencies as a means of evading sanctions and obtaining hard currencies to fund the regime,” the report stated.

The Associated Press contributed to this report. 

Katherine Lam is a breaking and trending news digital producer for Fox News. Follow her on Twitter at @bykatherinelam