North Korea's Cyber War: Funding Missiles Through Crypto Heists and Deception

Tim Draper, a leading venture capitalist and advocate for Bitcoin, has called on the U.S. government to enhance its financial security in light of escalating threats from North Korea. His warnings come amid a surge in North Korean cyber attacks targeting cryptocurrency firms, a trend that has intensified in the first half of 2025. Draper specifically highlighted the persistent efforts of North Korean actors to undermine American enterprises, particularly through cryptocurrency heists and infiltration of companies via deceptive job applications and bribery.

North Korean hackers have been linked to a series of sophisticated cyber operations that have compromised crypto firms and individuals across the globe. The most significant of these incidents was the $1.5 billion Bybit hack, attributed to the Lazarus Group, a hacking collective believed to be affiliated with the North Korean government. This breach alone accounted for roughly 69% of all funds stolen from cryptocurrency services in the first half of 2025. Additionally, North Korean operatives have been engaging in elaborate infiltration schemes, including the creation of fake U.S. companies and the use of social engineering tactics to gain access to sensitive systems. These attacks have evolved to include malware campaigns such as PylangGhost, which targets crypto wallet developers through deceptive job interview websites.

The scale of North Korean cybercrime has also been underscored by data from Chainalysis, which reported that over $2.17 billion in cryptocurrency was stolen globally in the first six months of 2025. Of this, nearly 70% was attributed to North Korean actors, with the Bybit breach being a major contributor. The stolen funds have been linked to the regime's nuclear and missile development programs, according to both U.S. and UN authorities. North Korea's cyber operations have become a central component of its sanctions evasion strategy, enabling the regime to access hard currency while circumventing international financial restrictions.

The methods employed by North Korean hackers have grown increasingly sophisticated. They now include advanced social engineering, zero-day exploits, and the use of fake LinkedIn profiles to infiltrate Western firms. These tactics have allowed operatives to gain insider access and exfiltrate sensitive data. In some cases, North Korean workers have been hired as remote employees by Western companies, using their positions to either steal intellectual property or extort firms for payment to avoid the disclosure of confidential files. These infiltration techniques have been described as a "dual strategy" that combines steady income from IT jobs with large-scale thefts from crypto exchanges.

In response to the growing threat, cybersecurity experts and law enforcement agencies have intensified their efforts to combat North Korean cybercrime. The U.S. Department of Justice has taken legal action against infrastructure that facilitates laundering of stolen crypto, including the recent conviction of Tornado Cash co-founder Roman Storm. The FBI has also confirmed the involvement of the Lazarus Group in the Bybit hack. These actions signal a broader shift in global enforcement strategies, with regulators and law enforcement focusing not just on the hackers but also on the infrastructure that enables money laundering and the movement of illicit funds.

The implications of these cyber threats extend beyond financial losses. They have raised concerns about the security of the crypto ecosystem and the potential for further destabilization. As North Korea's cyber operations evolve, the need for robust security measures—ranging from employee screening to advanced threat detection—has become more urgent. Both institutional and individual crypto holders are being advised to adopt stronger security protocols, including the use of multi-signature wallets and cold storage solutions. The increasing frequency and complexity of these attacks highlight the necessity for a coordinated global response to mitigate the risks posed by North Korean cyber threats.

"Bitcoin Booster Tim Draper Warns of North Korean Threat," Cryptonews.net, [https://cryptonews.net/news/security/31645638/](https://cryptonews.net/news/security/31645638/)

"CZ Warns of Advanced North Korean Hackers Posing as Job Candidates to Infiltrate Crypto Companies," Cryptonews.com, [https://cryptonews.com/news/cz-warns-of-advanced-north-korean-hackers-posing-as-job-candidates-to-infiltrate-crypto-companies/](https://cryptonews.com/news/cz-warns-of-advanced-north-korean-hackers-posing-as-job-candidates-to-infiltrate-crypto-companies/)

"Alleged North Korea’s 2025 Crypto Hacks | Largest Heist Ever," BeInCrypto, [https://beincrypto.com/north-korea-crypto-hacks-2025/](https://beincrypto.com/north-korea-crypto-hacks-2025/)

"2025 Crypto Crime Mid-Year Update - Chainalysis," Chainalysis, [https://www.chainalysis.com/blog/2025-crypto-crime-mid-year-update/](https://www.chainalysis.com/blog/2025-crypto-crime-mid-year-update/)

"North Korean hackers blamed for record spike in crypto thefts in 2025," TechCrunch, [https://techcrunch.com/2025/07/17/north-korean-hackers-blamed-for-record-spike-in-crypto-thefts-in-2025/](https://techcrunch.com/2025/07/17/north-korean-hackers-blamed-for-record-spike-in-crypto-thefts-in-2025/)

"2025 Cyber Threat Landscape Report: Cybercrime in the Crypto Space," Kroll, [https://www.kroll.com/en/reports/cyber/threat-intelligence-reports/threat-landscape-report-lens-on-crypto](https://www.kroll.com/en/reports/cyber/threat-intelligence-reports/threat-landscape-report-lens-on-crypto)