G7 Calls for Joint Action Against North Korean Crypto Theft and Cybercrime

North Korea has long dispatched IT workers overseas to apply remotely for technology jobs using false identities, stolen data belonging to U.S. residents and “laptop farms,” then remit most of their salaries to Pyongyang. Such operations target blockchain and cryptocurrency companies and may also involve planting malware and stealing confidential information. The proceeds are alleged to fund North Korea’s nuclear weapons and ballistic missile programs.

On March 12, 2026, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned six individuals and two entities, saying the network generated nearly $800 million for North Korea in 2024. A Vietnam-based operator converted about $2.5 million in cryptocurrency between mid-2023 and mid-2025. On April 15, the U.S. Justice Department separately announced that two accomplices had been sentenced to 92 and 108 months in prison for helping infiltrate more than 100 companies and generate over $5 million in revenue.

North Korea has long faced sweeping United Nations sanctions that restrict its legal exports and access to the financial system. It has consequently made cryptocurrency theft an important source of foreign currency to fund its nuclear weapons and ballistic missile programs. SVRN Chief Operating Officer Dave Schwed said Pyongyang targets exchanges, wallets and DeFi platforms rather than treating cryptocurrency merely as a payment tool.

CoinDesk reported on April 12, 2026, that North Korean hackers had recently spent six months infiltrating Drift, using false identities and long-term relationship-building to gain critical access. In the February 21, 2025, attack on Bybit, they moved $1.5 billion in about 30 minutes. The incident underscored both the difficulty of reversing on-chain transactions and the extremely short window for blocking stolen funds.