UNITED NATIONS: North Korea laundered $147.5 million through virtual currency platform Tornado Cash in March after stealing it last year from a cryptocurrency exchange, according to confidential work by United Nations sanctions monitors seen by Reuters on Tuesday.
The monitors told a U.N. Security Council sanctions committee in a document submitted on Friday that they had been investigating 97 suspected North Korean cyberattacks on cryptocurrency companies between 2017 and 2024, valued at some $3.6 billion.
That included an attack late last year where $147.5 million was stolen from HTX cryptocurrency exchange before being laundered in March this year, the monitors told the committee, citing information from crypto analytics firm PeckShield and blockchain research firm Elliptic.
In 2024 alone, the monitors said they had been looking at “11 cryptocurrency thefts … valued at $54.7 million,” adding that many of those “may have been conducted by DPRK IT workers inadvertently hired by small crypto-related companies.”
The monitors said that according to U.N. member states and private companies, North Korean IT workers operating abroad generate “substantial income for the country.”
Formally known as the Democratic People’s Republic of Korea (DPRK), North Korea has been under U.N. sanctions since 2006 and those measures have been strengthened over the years in a bid to cut funding for its ballistic missile and nuclear programs.
The U.S. sanctioned Tornado Cash in 2022 over accusations it supports North Korea. Two of its co-founders were charged in 2023 with facilitating more than $1 billion in money laundering, including for a cybercrime group linked to North Korea.
Lawyers for Tornado Cash co-founder Roman Storm, who pleaded not guilty to the U.S. charges in September, did not immediately respond to a request for comment.
So-called virtual currency “mixer” platforms such as Tornado Cash take the cryptocurrencies of many users and mash them together to help hide the source and owners of the funds.
The U.N. sanctions monitors were disbanded at the end of April after Russia vetoed the annual renewal of their mandate. Some of the monitors submitted unfinished work, which was shared with the council’s North Korea sanctions committee on Friday.
Traditionally, reports by the sanctions monitors are first agreed by all eight members. The unfinished work submitted to the committee did not go through that process.
The monitors said they had been investigating a February 6 New York Times report that Russia released $9 million out of $30 million in frozen North Korean assets and allowed Pyongyang to open an account at a Russian bank in South Ossetia so it could better obtain access to international banking networks.
The monitors also said ships suspected of involvement in arms trade between North Korea and Russia had continued voyages carrying containers between North Korea’s Rajin port and Russian ports, including Vladivostok and Vostochny.
The sanctions monitors said one particular ship called the Angara had been at China’s Ningbo port since February, where it may have been undergoing maintenance. Reuters has reported that China was providing moorage for the ship.
Russia’s mission to the U.N. in New York declined to comment on the monitors’ work. China’s U.N. mission did not immediately respond to a request for comment.
The U.S. and others have accused North Korea of transferring weapons to Russia for use against Ukraine, which it invaded in February 2022. Both Moscow and Pyongyang have denied the accusations, but vowed last year to deepen military relations.
(REUTERS)
