Seoul: North Korea stole approximately $2.84 billion in virtual assets between early 2024 and September 2025, laundering most of these funds through countries such as China and Russia, according to an international monitoring report released by Seoul's foreign ministry.
According to Yonhap News Agency, the latest report by the Multilateral Sanctions Monitoring Team (MSMT) revealed the involvement of around 2,000 North Korean IT workers in the heist, which aimed to generate hard currency for the Kim Jong-un regime. The MSMT, established in October of the previous year by South Korea and the United States, serves as an alternative framework to the now-disbanded U.N. Panel of Experts on North Korean sanctions.
The report highlighted that the stolen assets originated from crypto exchanges in the Middle East and Asia, including Bybit in the UAE, DMM Bitcoin in Japan, WazirX in India, and BingX Phemex in Singapore. Notably, Pyongyang reportedly stole $1.65 billion in virtual assets in 2025 alone.
The North Korean IT workers, who were based in at least eight countries such as China and Russia, remitted about half of their earnings back to North Korea. Many of these workers were linked to government entities sanctioned under U.N. Security Council resolutions, such as the Ministry of Atomic Energy Industry.
The report also noted that North Korean cyber groups employed tactics like impersonating investors to install malware and steal crypto assets. Additionally, Pyongyang has been collaborating with Russian ransomware groups and using advanced tools like ChatGPT to enhance their cyber operations.
China's financial systems and nationals were identified as being deeply involved in these schemes, which are believed to fund weapons transactions and secure banned resources. With increased U.S. crackdowns, North Korea has expanded operations to IT firms in Europe.
The report also accused North Korea of launching cyberattacks to steal sensitive information from countries including the U.S. and South Korea. A joint statement by MSMT participating countries described these activities as efforts to finance North Korea's unlawful weapons programs.
The report urged the reestablishment of the U.N. Panel of Experts, calling for global diplomatic efforts to address the threats posed by North Korea's actions.