North Korean cryptocurrency theft provides a material source of funding for the country’s weapons programs

What's this about?

People disagree about whether North Korea uses stolen crypto money to help pay for weapons.

The evidence points that way, but we cannot trace each stolen dollar to one weapon.

What supporters say

• U.S. and world groups link North Korean cyber money to nuclear and missile work.
• North Korean agents use many wallets, helpers, and money trades to turn stolen crypto into spendable cash.
• The thefts reached about $660 million in 2023 and $1.34 billion in 2024.
• For a country with few ways to earn foreign money, these sums could matter greatly.

What critics say

• No public proof shows exactly how much stolen money paid for a missile, bomb, or deal.
• Some theft totals and links to North Korea come from private groups’ own estimates.

How to read this

The number of points on each side does not show who is right; stronger proof matters more.

The bottom line

The evidence shows that crypto theft likely gives North Korea a real source of money for its weapons plans.

Still, we are not sure how much money reaches any one weapon site or purchase.

North Korea’s cryptocurrency theft appears to be a material source of funding for its weapons programs, but the public evidence cannot show exactly how much stolen money reaches a particular missile, nuclear facility or procurement deal.

The case for

The strongest argument is the scale of the alleged theft. Estimates put North Korea-linked cryptocurrency theft at about $660.5 million across 20 incidents in 2023 and $1.34 billion across 47 incidents in 2024 (see Figure 1). These figures represent identified theft, not confirmed weapons spending. But for a heavily sanctioned country with limited access to foreign currency, sums of this size could be materially important. 1

Government and international assessments also connect North Korean cyber income with prohibited weapons activity. A United Nations sanctions panel said malicious cyber operations generated substantial foreign-currency revenue that helped North Korea evade sanctions and support its nuclear and ballistic-missile programs. The U.S. Treasury has similarly said that North Korea’s cyber operations and illicit IT-worker schemes help finance its weapons-of-mass-destruction and ballistic-missile programs. 2

A Justice Department indictment linked cryptocurrency theft and laundering operations to North Korean military-intelligence personnel. The indictment contains allegations rather than a final court finding, and it does not show where every dollar ultimately went. Still, it adds to the case that the activity is tied to the state rather than being ordinary criminal conduct.

The money also appears capable of being turned into usable funds. Treasury has identified millions of dollars moving through cryptocurrency cash-outs and money mules. Court filings describe thousands of bitcoins being sent through dozens of addresses to hide their origin and make them easier to move. Recorded Future has reported similar layers of laundering into conventional currency and assessed cryptocurrency theft as a major source of revenue for North Korea’s military and weapons activities. 3

The case against

The main weakness is the absence of a public, dollar-by-dollar trail from stolen cryptocurrency to weapons spending. Recorded Future has said it is unclear how much money directly financed individual missile launches, while related reporting says direct links to particular ballistic-missile or nuclear expenditures are unavailable. The evidence therefore supports a connection to a broader weapons-financing system more clearly than it proves payment for any specific weapon or facility. 4

There is also uncertainty about the totals themselves. Key estimates come from commercial blockchain-intelligence companies such as Chainalysis and TRM Labs. Their work uses visible blockchain transactions, but also proprietary methods and probabilistic judgments about who is responsible for particular attacks. The figures may change as investigations develop, may omit undiscovered thefts, or may include cases that have not been established in court. 5

The public record also does not clearly separate cryptocurrency theft from other forms of cybercrime, illicit IT-worker income and broader state revenue. Official statements sometimes discuss these activities together. That makes it difficult to calculate cryptocurrency theft’s exact share of North Korea’s weapons budget.

The bottom line

The evidence favours the claim, but only with low confidence and important limits. It is stronger on the existence, scale and usability of North Korea’s stolen cryptocurrency revenue than on its final destination or exact contribution to weapons spending.

The most defensible conclusion is that cryptocurrency theft materially contributes to North Korea’s weapons-funding ecosystem. Large sums have been attributed to North Korean-linked operations, laundering networks have helped convert them into usable funds, and the United Nations and U.S. government have connected cyber-derived revenue to prohibited weapons programs.

But the evidence does not show that cryptocurrency theft is North Korea’s sole or largest funding source, nor does it establish a fixed percentage of weapons spending. The central gap is a publicly auditable record tracing identified stolen funds to specific procurement channels, facilities, launches or other weapons expenditures.