According to confidential work by United Nations sanctions monitors seen by Reuters, North Korea laundered $147.5 million through the virtual currency platform Tornado Cash in March after stealing it last year from a cryptocurrency exchange.
The monitors informed a UN Security Council sanctions committee in a document submitted on Friday that they had been investigating 97 suspected North Korean cyberattacks on cryptocurrency companies between 2017 and 2024, valued at around $3.6 billion.
This included an attack late last year where $147.5 million was stolen from HTX cryptocurrency exchange before being laundered in March through Tornado Cash, as cited by crypto analytics firm PeckShield and blockchain research firm Elliptic.
In 2024 alone, the monitors said they had been looking at “11 cryptocurrency thefts … valued at $54.7 million,” adding that many of those “may have been conducted by DPRK IT workers inadvertently hired by small crypto-related companies.”
The monitors stated, “According to U.N. member states and private companies, North Korean IT workers operating abroad generate ‘substantial income for the country.'”
The U.S. sanctioned Tornado Cash in 2022 over accusations it supports North Korea. Two of its co-founders were charged in 2023 with facilitating more than $1 billion in money laundering, including for a cybercrime group linked to North Korea.
The monitors also reported investigating ships suspected of involvement in arms trade between North Korea and Russia, including the Angara, which has been at China’s Ningbo port since February, potentially undergoing maintenance.
They wrote, “The DPRK and its facilitators continue to evade sanctions through maritime means, including with the ongoing acquisition by the DPRK of vessels, import of refined petroleum including via ship-to-ship transfer, and export of coal.”
The monitors said they had been investigating information about 208 voyages by North Korean cargo ships to offload coal in Chinese coastal waters, likely via ship-to-ship transfers. They stated, “Chinese Coast Guard vessels were on several occasions identified in close proximity to DPRK vessels suspected of offloading coal in Chinese waters.”
The UN sanctions monitors were disbanded at the end of April after Russia vetoed the renewal of their mandate. Some submitted unfinished work, which was shared with the council’s North Korea sanctions committee on Friday without the traditional process of being agreed upon by all members.
North Korea, formally known as the Democratic People’s Republic of Korea, has been under UN sanctions since 2006, aimed at cutting funding for its ballistic missile and nuclear programs.