Money for missiles: Crypto heists pay for North Korea’s nukes

North Korea’s parade of 11 intercontinental ballistic missiles through the streets of Pyongyang this week put on display a force that analysts say is capable of overwhelming the systems the U.S. military has put up to defend the homeland.

But the progress made by North Korean armorers raises an economic question in addition to the strategic one: How is the world’s richest country vulnerable to an impoverished state with an isolated, backward economy that ranks 135th in the world in national wealth?

Political will is clearly one answer. Regime head Kim Jong-un has made weapons development a focal economic priority. “For the strengthening and development of our armed forces, let us all double our efforts and do more for the prosperous development of the socialist motherland,” Mr. Kim said at a banquet this week, according to reports in the state media.

But that still begs the question of how North Korea, even more isolated economically after closing its borders since COVID-19 struck, earn the hard currency to underwrite the research, manufacture and deployment of its massive, nuclear-armed hardware

Part of the answer, South Korean officials and analysts say, is a specialized corps of online hackers who last year clandestinely brought in between $1.7 billion and $2 billion to finance North Korea’s military-industrial complex.

“There are many different departments in North Korea that send [abroad] IT workers and many of these organizations are listed under U.N. sanctions for [weapons of mass destruction] procurement,” said Chai Kyung-hoon, director of the North Korean Nuclear Policy Division of Seoul’s Ministry of Foreign Affairs.

“What we are finding is these IT workers are playing an integral role in providing funds and procuring materials and components for nuclear missile development,” Mr. Chai told a major conference in Seoul Thursday on state threats in cyberspace.

Joint international efforts to choke off this money supply are just now getting off the ground, experts say.

Kim’s pricy arsenal

At North Korea’s 8th Party Congress in January 2021, Mr. Kim laid out a wish list of weapons so ambitious it made outside analysts gasp.

Key items included a “super-large” hydrogen bomb, tactical nuclear devices, mid- and long-range cruise missiles, anti-aircraft missiles, heavy tanks, multiple-warhead missiles, “hypersonic gliding flight warheads,” long-range drones, reconnaissance satellites — and the country’s first nuclear submarine.

While Pyongyang had conducted no nuclear tests since 2017, North Korea last year abruptly stepped up the pace of weapons activity, staging more tests of multiple classes of missiles and drones in one year than ever before. The tests included ICBMs, ballistic missiles with variable flight paths, long-range cruise missiles, and various tactical weapons, including long-range multiple-rocket systems, or MLRS.

While stiff-arming the Biden administration’s offers of direct talks, Pyongyang has only conducted one missile test so far in 2023. But Wednesday’s midnight parade showed that Mr. Kim is ticking off the items on his list.

Analysis of the photos of the parade that ran in South Korean media outlets suggested that, in addition to the 11 ICBMs, the North Korean military had put on display mock-ups of the first solid-fuel ICBMs in development by Pyongyang. Also mounted on specialized vehicles were 240mm MLRS, tactical guided missiles and what are believed to be new cruise missiles, along with a new tank.

It was an impressive — and expensive — display, again raising questions of where the Kim regime was getting the money to pull it off.

The U.S. Treasury’s “2021 Military Expenditures and Arms Transfers” report estimated that North Korea spends some $4 billion annually on its military, about 26% of GDP.

No other power comes close. According to the latest numbers from the World Bank, China spends 1.7% of GDP on its military, South Korea spends 2.8%, the US 3.5%, Russia 4.1% and Israel 5.2%.

To ease the burden arms development places on its national economy, North Korea is acquiring extra-national funds. The favored method is theft, carried out by a dedicated corps of cyber operatives.

Low visibility, high reward

North Korea’s cyber pilfering is not new. In 2016, North Korea hackers stole $81 million from the Bank of Bangladesh. In 2017, their infamous “Wanna-Cry” attack infected computers in 150 countries with ransomware.

But more recent operations have been especially low-visibility, high-reward. The leading target is the still-murky, lightly regulated world of cryptocurrencies.

“North Korea’s operatives, using keyboards rather than guns, stealing digital wallets of cryptocurrency instead of sacks of cash, are the world’s leading bank robbers,” the U.s. Justice Department charged in a 2021 indictment of three North Korean programmers.

The operatives work in two ways, Mr. Chai explained at the Seoul conference

One is through heists of cryptocurrencies, which he estimated earned Pyongyang $1.7 billion last year. The second is through the export of workers to global IT forms, who earn “hundreds of millions of dollars” in hard currency by creating apps and cryptocurrency-related products.

Though the Internet is borderless, the operatives deploy overseas to acquire the skills, network access and foreign currencies they need. They operate in countries such as China, Cambodia, China, Malaysia, Thailand and Vietnam.

Thae Yong-ho, a North Korean defector and South Korean parliamentarian, told foreign reporters earlier this month that the North Korean IT candidates receive four years of specialized education before moving abroad to take jobs under assumed identities.

“When you develop games or programs, there are no borders or barriers,” Mr. Thae said. “So, it is very difficult to verify the identities of IT workers.”

Once employed, they purchase software and hone network-infiltration techniques, Mr. Thae said. There are North Koreans secretly working for Indian, Japanese, South Korean and U.S.-owned companies, he claimed.

Some operatives establish their own companies, often in Southeast Asia, with the mission of carrying out direct hacking and cyber theft operations.

Fighting back

Belated countermoves to cut off the North’s funding spigots are getting underway.

South Korea and the U.S. last year established a joint working group that combined law enforcement, intelligence, defense and finance experts to address the North’s financing channels. The group generated “a list of concrete actions” to be taken, Mr. Chai said, though he gave no details.

There is also ongoing cooperation between the UK’s MI5 and South Korea cyber authorities, and last year, South Korea’s National Intelligence Service joined NATO’s Cooperative Cyber Defense Center of Excellence.

While Western partners bring advanced techniques and technologies, South Korea can share the lessons learned from painful experience.

“We have been attacked by the North a lot. so we have learned lessons and information and we can share this,” said Oh Il-sook, a cybersecurity expert at Seoul’s Institute for National Security Strategy. “We can show the characteristics of North Korea technologies and attacks.”