By Michelle Nichols
UNITED NATIONS (Reuters) – North Korea laundered $147.5 million through virtual currency platform Tornado Cash in March after stealing it last year from a cryptocurrency exchange, according to confidential work by United Nations sanctions monitors seen by Reuters on Tuesday.
The monitors told a U.N. Security Council sanctions committee in a document submitted on Friday that they had been investigating 97 suspected North Korean cyberattacks on cryptocurrency companies between 2017 and 2024, valued at some $3.6 billion.
That included an attack late last year where $147.5 million was stolen from HTX cryptocurrency exchange before being laundered in March this year, the monitors told the committee, citing information from crypto analytics firm PeckShield and blockchain research firm Elliptic.
In 2024 alone, the monitors said they had been looking at “11 cryptocurrency thefts … valued at $54.7 million,” adding that many of those “may have been conducted by DPRK IT workers inadvertently hired by small crypto-related companies.”
The monitors said that according to U.N. member states and private companies, North Korean IT workers operating abroad generate “substantial income for the country.”
Formally known as the Democratic People’s Republic of Korea (DPRK), North Korea has been under U.N. sanctions since 2006 and those measures have been strengthened over the years in a bid to cut funding for its ballistic missile and nuclear programs.
North Korea’s mission to the U.N. in New York did not immediately respond to a request for comment.
The U.S. sanctioned Tornado Cash in 2022 over accusations it supports North Korea. Two of its co-founders were charged in 2023 with facilitating more than $1 billion in money laundering, including for a cybercrime group linked to North Korea.
Lawyers for Tornado Cash co-founder Roman Storm, who pleaded not guilty to the U.S. charges in September, did not immediately respond to a request for comment.
So-called virtual currency “mixer” platforms such as Tornado Cash take the cryptocurrencies of many users and mash them together to help hide the source and owners of the funds.
The U.N. sanctions monitors were disbanded at the end of April after Russia vetoed the annual renewal of their mandate. Some of the monitors submitted unfinished work, which was shared with the council’s North Korea sanctions committee on Friday.
Traditionally, reports by the sanctions monitors are first agreed by all eight members. The unfinished work submitted to the committee did not go through that process.
The monitors said they had been investigating a Feb. 6 New York Times report that Russia released $9 million out of $30 million in frozen North Korean assets and allowed Pyongyang to open an account at a Russian bank in South Ossetia so it could better obtain access to international banking networks.
ILLICIT ARMS, COAL
The monitors also said ships suspected of involvement in arms trade between North Korea and Russia had continued voyages carrying containers between North Korea’s Rajin port and Russian ports, including Vladivostok and Vostochny.
The sanctions monitors said one particular ship called the Angara had been at China’s Ningbo port since February, where it may have been undergoing maintenance. Reuters has reported that China was providing moorage for the ship.
Russia’s mission to the U.N. in New York declined to comment on the monitors’ work. China’s U.N. mission did not immediately respond to a request for comment.
The U.S. and others have accused North Korea of transferring weapons to Russia for use against Ukraine, which it invaded in February 2022. Both Moscow and Pyongyang have denied the accusations, but vowed last year to deepen military relations.
In a separate report last month, U.N. sanctions monitors told the Security Council that debris from a missile that landed in the Ukrainian city of Kharkiv on Jan. 2 was from a North Korean Hwasong-11 series ballistic missile.
The U.N. Security Council has banned North Korean exports including coal, iron, lead, textiles and seafood, and capped imports of crude oil and refined petroleum products.
“The DPRK and its facilitators continue to evade sanctions through maritime means, including with the ongoing acquisition by the DPRK of vessels, import of refined petroleum including via ship-to-ship transfer, and export of coal,” the monitors wrote.
The monitors said they had been investigating information from an unnamed member state about 208 voyages by North Korean cargo ships to offload coal in Chinese coastal waters, adding it was likely that most took place via ship-to-ship transfers.
“Chinese Coast Guard vessels were on several occasions identified in close proximity to DPRK vessels suspected of offloading coal in Chinese waters,” the monitors wrote.
China’s U.N mission did not immediately respond to a request for comment.
(Reporting by Michelle Nichols; Editing by Don Durfee and Deepa Babington)