North Korean Hackers Target Bitcoin

North Korean hackers are increasing their attacks on cryptocurrency exchanges to try to secure bitcoin and other cryptocurrencies.

Bloomberg Technology reported that the country’s hackers have hit cryptocurrency exchanges in South Korea and related sites, and also breached an English-language bitcoin news website and collected bitcoin ransom payments from global victims of the malware WannaCry.

The cryptocurrencies could be used to help North Korea avoid trade restrictions, including recent sanctions approved by the United Nations Security Council. U.S. officials said the new measures would cut the country’s textile exports by 90 percent, restricting its ability to get hard currency.

“We definitely see sanctions being a big lever driving this sort of activity,” said Luke McNamara, a researcher at FireEye and author of the new report. “They probably see it as a very low-cost solution to bring in hard cash.”

FireEye has confirmed cyberattack strikes on at least three South Korean exchanges so far in 2017. And in May, Seoul-based exchange Yapizon lost more than 3,800 bitcoins (worth about $15 million at current rates) due to theft, although there is no proven news of North Korean involvement.

South Korea may have become a target because it’s currently one of the busiest trading hubs for cryptocurrencies. The attacks were carried out through spear-phishing attacks, or emailing files laced with malware to specific targets.

The group behind the hacks, TEMP.Hermit, has been involved in many cases of bitcoin theft, including a 2015 attack on South Korea’s nuclear industry. The hackers have also been tied to last year’s attack on Samsung’s corporate messenger app, as well as the breach of Sony’s film studio. The FBI is also investigating North Korea’s link to last year’s theft of $81 million through the Federal Reserve Bank of New York.

“As more money goes into cryptocurrency exchanges and more people buy bitcoin and ethereum, exchanges become larger targets for this group,” said McNamara.

And while McNamara said he did not have evidence that North Korea has targeted cryptocurrency exchanges outside of South Korea, he did not rule out the possibility of future cybercrime.