North Korea launders $148 million of stolen crypto using Tornado Cash

A UN sanctions investigation has discovered that North Korea laundered $147.5 million through virtual currency platform Tornado Cash just this March – after IT workers for the communist regime stole the digital funds last year from the HTX cryptocurrency exchange.

The information was released in confidential documents prepared by United Nations sanctions monitors and seen exclusively by Reuters on Tuesday.

The monitors told a U.N. Security Council sanctions committee in a document submitted on Friday that they had been investigating 97 suspected North Korean cyberattacks on cryptocurrency companies between 2017 and 2024, valued at some $3.6 billion.

That included an attack late last year where $147.5 million was stolen from HTX cryptocurrency exchange before being laundered in March this year, the monitors told the committee, citing information from crypto analytics firm PeckShield and blockchain research firm Elliptic.

In 2024 alone, the monitors said they had been looking at "11 cryptocurrency thefts ... valued at $54.7 million," adding that many of those "may have been conducted by DPRK IT workers inadvertently hired by small crypto-related companies."

The monitors said that according to U.N. member states and private companies, North Korean IT workers operating abroad generate "substantial income for the country."

Formally known as the Democratic People's Republic of Korea (DPRK), North Korea has been under U.N. sanctions since 2006 and those measures have been strengthened over the years in a bid to cut funding for its ballistic missile and nuclear programs.

North Korea's mission to the U.N. in New York did not immediately respond to a request for comment.

The U.S. sanctioned Tornado Cash in 2022 over accusations it supports North Korea. Two of its co-founders were charged in 2023 with facilitating more than $1 billion in money laundering, including for a cybercrime group linked to North Korea.

Lawyers for Tornado Cash co-founder Roman Storm, who pleaded not guilty to the U.S. charges in September, did not immediately respond to a request for comment.

So-called virtual currency "mixer" platforms such as Tornado Cash take the cryptocurrencies of many users and mash them together to help hide the source and owners of the funds.

The U.N. sanctions monitors were disbanded at the end of April after Russia vetoed the annual renewal of their mandate. Some of the monitors submitted unfinished work, which was shared with the council's North Korea sanctions committee on Friday.

Traditionally, reports by the sanctions monitors are first agreed by all eight members. The unfinished work submitted to the committee did not go through that process.

The monitors said they had been investigating a February 6th New York Times report that Russia released $9 million out of $30 million in frozen North Korean assets and allowed Pyongyang to open an account at a Russian bank in South Ossetia so it could better obtain access to international banking networks.

The UN sanctions monitors also said ships suspected of involvement in arms trade between North Korea and Russia had continued voyages carrying containers between North Korea's Rajin port and Russian ports, including Vladivostok and Vostochny.