Exclusive-North Korea laundered $147.5 million in stolen crypto in March, say UN experts

By Michelle Nichols

UNITED NATIONS (Reuters) – North Korea laundered $147.5 million through virtual currency platform Tornado Cash in March after stealing it from a cryptocurrency exchange last year, according to an undercover study by United Nations sanctions monitors seen by Reuters on Tuesday.

They are investigating 97 suspected North Korean cyberattacks on cryptocurrency companies between 2017 and 2024 worth about $3.6 billion, monitors told the U.N. Security Council sanctions committee in a document submitted Friday.

This included an attack in which $147.5 million was stolen from the HTX cryptocurrency exchange late last year and laundered in March of this year, observers told the committee, citing information from crypto analysis firm PeckShield and blockchain research firm Elliptic.

Observers noted that they examined “11 cryptocurrency thefts worth $54.7 million” in 2024 alone, adding that most of them “may have been carried out by North Korean IT workers mistakenly hired by small crypto-related companies.”

North Korean IT workers operating abroad provide “significant income for the country,” according to U.N. member states and private companies, observers said.

North Korea, officially known as the Democratic People’s Republic of Korea (DPRK), has been under UN sanctions since 2006, and these measures have been strengthened over the years in an attempt to cut funding for its ballistic missile and nuclear programs.

North Korea’s UN mission in New York did not immediately respond to a request for comment.

The US imposed sanctions on Tornado Cash in 2022 over accusations that it supports North Korea. Two of its co-founders were charged in 2023 with facilitating the laundering of more than $1 billion in money, including from a cybercrime group with ties to North Korea.

Lawyers for Tornado Cash co-founder Roman Storm, who pleaded not guilty to U.S. charges in September, did not immediately respond to a request for comment.

So-called virtual currency “mixers” platforms, such as Tornado Cash, take the cryptocurrencies of many users and mix them together to help disguise the source and owners of the funds.

UN sanctions monitors were disbanded at the end of April after Russia vetoed the annual renewal of their mandate. Some of the observers presented unfinished studies that were shared with the council’s North Korea sanctions committee on Friday.

Traditionally, sanctions monitors’ reports are first accepted by all eight members. Incomplete work presented to the committee did not go through this process.

The story continues

Observers reported that Russia had released $9 million of North Korea’s $30 million in frozen assets, according to a report published in the New York Times on February 6, allowing Pyongyang to open an account in a Russian bank in South Ossetia, providing more access to North Korea. He said that they were investigating the news that it could provide good access. international banking networks

ILLEGAL WEAPONS, COAL

Observers also said that ships suspected of being involved in the arms trade between North Korea and Russia continued their container-carrying voyages between North Korea’s Rajin port and Russian ports including Vladivostok and Vostochny.

Sanctions monitors said one particular ship, the Angara, had been in the Chinese port of Ningbo since February and may have been undergoing maintenance there. Reuters reported that China provided anchorage for the ship.

Russia’s UN mission in New York declined to comment on the observers’ work. China’s mission to the UN did not immediately respond to a request for comment.

The United States and others have accused North Korea of ​​transferring weapons to Russia for use against Ukraine, which it invaded in February 2022. Both Moscow and Pyongyang have denied the accusations, but vowed last year to deepen military ties.

In a separate report published last month, UN sanctions monitors told the Security Council that debris from the missile that crashed in Kharkiv, Ukraine, on January 2 was from North Korea’s Hwasong-11 series ballistic missile.

The UN Security Council has banned North Korean exports, including coal, iron, lead, textiles and seafood, and imposed limits on imports of crude oil and refined petroleum products.

“North Korea and its enablers continue to evade sanctions by sea, including through North Korea’s ongoing ship purchases, imports of refined oil through ship-to-ship transfers, and exports of coal,” observers wrote. he wrote.

Observers said they were investigating information from an unnamed member state about 208 voyages by North Korean cargo ships to unload coal into Chinese coastal waters, adding that most of them probably occurred via ship-to-ship transfer.

“Chinese Coast Guard ships have been detected multiple times in close proximity to North Korean ships suspected of dumping coal into Chinese waters,” observers wrote.

China’s mission to the UN did not immediately respond to a request for comment.

(Reporting by Michelle Nichols; Editing by Don Durfee and Deepa Babington)