The international community imposed crippling sanctions on North Korea in 2006 after it conducted its first nuclear arms test. The sanctions, which remain in place, target traditional exports such as minerals and textiles. Combined with North Korea’s limited economy and lack of trading partners, the sanctions leave dictator Kim Jong Un desperate for revenue to sustain his regime and nuclear program.
Increasingly, the regime has turned to illicit sources of revenue. North Korea still engages in some licit trade and domestic production of weapons, iron ore, coal, seafood and other goods. However, the regime’s reliance on cybercrime, particularly cryptocurrency theft, as well as currency counterfeiting operations, methamphetamine production and exploitation of overseas labor are increasingly crucial to its financial survival and militarization. Cyber theft provides an estimated 50% of Pyongyang’s foreign currency revenue and is the primary funding source for its weapons programs.
North Korea’s cyber capabilities have transformed significantly over the past decade. The regime has cultivated a cyberwarfare/revenue apparatus capable of financial heists targeting cryptocurrency exchanges and banks. These operations, often attributed to state-sponsored hackers such as the Lazarus Group and Advanced Persistent Threat (APT) 38, have netted the regime billions of dollars. Experts estimate that over 8,000 hackers are part of the North Korean cyber force.
The hackers employ tactics such as spear phishing targeting employees in the cryptocurrency industry and exploiting vulnerabilities in blockchain platforms. North Korea’s theft of bitcoin and other cryptocurrencies allows the regime to bypass traditional financial systems — making it harder for authorities to trace and seize funds — and surreptitiously convert stolen digital assets into hard currency.
North Korea stole over $630 million in cryptocurrency in 2022 and $1.34 billion in 2024, the United Nations estimates. In February 2025, the Lazarus Group stole $1.5 billion in Ethereum from the Bybit exchange — the largest cryptocurrency theft in history. The regime launders stolen funds through complex networks. It mixes cryptocurrency that passes through hundreds of digital wallets and obfuscates blockchain transactions through decentralized exchanges to obscure the funds’ final destination.
The regime’s exploitation of North Korean workers it sends abroad also is a significant source of its revenue. Tens of thousands of North Koreans are sent to work in China and Russia, as well as in Africa and Southeast Asia. Often employed in fishing, construction, mining, logging and textiles, they are subjected to harsh conditions and up to 90% of their wages are confiscated by the regime.
U.N. sanctions call for the workers to be repatriated, but North Korea uses forged documents, front companies and other deceptive practices to circumvent the restrictions. Countries using North Korean laborers often hide them from foreign authorities and public view. The Kim regime uses the hard currency generated by forced labor to finance its military programs, including its nuclear arsenal, and maintain its grip on power.
China continues to trade with North Korea and facilitate some of its illicit activities.
North Korea’s shadow economy poses a security threat to the international community, not only because it funds the rogue state’s illegal weapons programs but also because of the growing danger of state-sponsored cybercrime.
Combating these activities requires a concerted international effort, including enhanced cybersecurity, stricter sanctions enforcement, improved intelligence sharing, tighter cryptocurrency regulation and improved private sector technology partnerships, along with continued diplomatic pressure. As North Korea’s cyber capabilities become more sophisticated, the challenge of disrupting the regime’s illicit activities will only become more complex.
