Borrowed Current

Signals from the Grid

Mara: May 2017. Researchers at Recorded Future, led by Priscilla Moriuchi, are watching North Korea's IP address space. That's the blocks of internet addresses assigned to the country, a bit like its postcode online. And bitcoin mining shows up, out of nowhere. It surges, several times over, and keeps climbing into 2019. Her team's read at the time: so few computers, so little address space, that 'it is not likely this computationally intensive activity is occurring outside of state control.'

Eli: And the listener who wrote in wants to know: is North Korea still mining bitcoin like crazy? How much do they allegedly have, and how did they get it? Today's angle is the trail behind North Korea's bitcoin surge.

Mara: On paper, it looks like a state quietly minting its own bitcoin. The trail behind that spike runs somewhere else: through coal sanctions, a strange Christmas Eve program, and apartments abroad where people work through the night.

Eli: Here's what makes that spike odd. Moriuchi's best guess is that in a country of 25 million, 'under 300 people' have access to the global internet. That small circle used VPNs to reach outside. In 2017, Recorded Future watched them buy things with bitcoin, stream video and browse Amazon.

Mara: So the mining came out of a network only a few hundred people can touch. Whether that was an industrial farm or something far smaller starts with a sanctions fight, Eli.

The Darkened Farm

Eli: It starts with coal. In 2013, North Korea passed Vietnam as the world's top exporter of anthracite. That year it brought in well over a billion dollars, a tenth of the whole economy, from one kind of coal. Then, January 2016: a nuclear test. The UN Security Council answers with some of its toughest sanctions, and that revenue gets squeezed. In that same window, 2015 to 2017, North Korea's cyber operations swing toward one goal: collecting money.

Mara: Which is just when that bitcoin spike appears. And on Christmas Eve, 2017, someone compiles a small program. Researchers at AlienVault pull it apart. It's cryptojacking: software that slips onto strangers' computers and quietly uses their processors to mine coins for someone else. These coins are Monero, and they're sent to Kim Il Sung University in Pyongyang. But the researchers hedged. The developers might not even be North Korean, they said, and it could be 'an experimental software' or 'a prank to trick security researchers.'

Eli: Someone else's machine, someone else's power bill. Recorded Future and the Belfer Center read North Korea's mining as real but limited: opportunistic Monero or bitcoin, on state machines and hijacked ones.

Mara: And Eli, the Boym Institute, Tara O and Priscilla Moriuchi read domestic mining as negligible, with hacking and direct theft far more lucrative and practical.

Eli: And theft was already moving. In 2017, North Korean cyber actors hit South Korean crypto exchanges, Bithumb and Youbit. Youbit went bankrupt. The attacks escalated after 2018, as crypto spread and breaking into traditional banks got harder.

Mara: There's a human version too. One defector described a two-bedroom apartment in China, shared with about ten other North Koreans. Bunk beds, computers, portraits of the leaders. They kept American business hours, so the day began in the afternoon and ended near sunrise—up to 16 hours of work. Late at night, after the others slept, he read foreign reporting about his own country, which he says changed how he saw the regime and helped push him to defect. Another defector, whose old friends worked on such teams, says they had no freedom, not even to leave the apartment except for groceries the team leader arranged.

Eli: And the money adds up. The US government estimates a typical team of these workers earns up to 3 million dollars a year for Pyongyang. That's one team.

Mara: So by the end of 2017, one sanctioned country is running four lines at once: a mining signal, a malware oddity pointed at a university, a bankrupt exchange, and apartments full of people working American hours.

The Thousand-Node Heist

Eli: Here's the piece that decides it. North Korea is badly short of electricity. Economic reports say even its mineral deposits often can't be mined, for lack of power, proper tools and an antiquated industrial base. That's the ground the Boym Institute, Tara O and Moriuchi stand on. Analysts and economic reports indicate that persistent grid blackouts made electricity-heavy crypto mining impractical next to the high yields of exchange theft.

Mara: So Moriuchi's 2017 spike reads differently now: a few hundred state connections, not a farm humming on a national grid.

Eli: The mining that does happen runs on other people's power. The Korea Times reported in 2018 North Korea was 'highly likely' using malicious software so hackers could mine without a trace. Cryptojacking sits on the Lazarus Group's list of tactics. Then, from August 2022, Mandiant saw a group it calls APT43 doing something stranger: paying cloud-mining services with stolen crypto and taking back fresh, untainted coins. Mandiant's read: a new way 'to cash out the funds it steals while preventing them from being seized or frozen.'

Mara: Mining as a laundromat, not a mint. Then came the big loads. March 2022: the Lazarus Group hits the Ronin Bridge, run by Sky Mavis. A cross-chain bridge lets tokens cross between separate blockchains, so it sits on a huge locked pool of them. Somewhere between 540 and 625 million dollars goes out. Ronin's own account said 'all evidence points to this attack being socially engineered, rather than a technical flaw.' Hundreds of millions then ran through Tornado Cash, a mixer, which pools many users' coins and pays them back out so the trail blurs.

Eli: Socially engineered: the locks held, and a person got talked into opening one.

Mara: That's the thread through all of it. The IT workers fake their way into jobs. Turned around, fake recruiters approach crypto developers on LinkedIn and Upwork with bogus job interviews. One campaign, Contagious Interview, is generally attributed by the security community to North Korea's government, though precise attribution is hard.

Eli: And it scales. February 2025: 1.5 billion dollars drained from Bybit, an exchange based in Dubai. By far the biggest theft in digital-asset history. The FBI pinned it on the Lazarus Group, published the Ethereum addresses tied to the money, and urged platforms to stop it moving. Much of it moved anyway. Most of the stolen Ether was swapped into bitcoin and spread across swap platforms like THORChain.

Mara: And then Drift Protocol. Through February and March 2026, people posing as a quantitative trading firm met Drift contributors face to face at industry conferences. In April, about 285 million dollars went out. Afterward, the funds sat unmoved. One threat analyst who studies North Korea said the whole thing reads like a spy novel.

Eli: TRM Labs says North Korea's share of all crypto hack losses was under a tenth in 2020. Through April 2026, it's 76 percent. How much of that still sits in wallets is the part nobody agrees on. And Mara, stolen coins in a wallet still have to become money a weapons program can spend.

The Sovereign Ledger

Mara: January 2026, a diplomatic briefing in Washington. Jonathan Fritz, from the US State Department, presents a sanctions monitoring report on North Korea. 'Like DPRK cyber actors,' he said, 'these DPRK IT workers also rely on foreign facilitators from across UN member states to secure employment, to provide support and to remit earnings back to DPRK entities.' The countries behind that monitoring team had already said North Korea steals and fraudulently obtains 'billions of dollars for its unlawful weapons of mass destruction and ballistic missile programs.'

Eli: And before stolen coins reach any facilitator, they're run through mixers, bridges, swaps and privacy coins like Monero. Bybit's Ether turning into bitcoin was one round of that.

Mara: The totals depend on who's counting. Across UN reports and blockchain analytics, estimates of what North Korea has stolen since 2017 start around 1.75 billion dollars. Even that low end beats the coal trade's best year. The high end is at least 6.75 billion.

Eli: Turning that into usable money runs through over-the-counter brokers: private dealers who trade directly between two parties, off the public exchanges. In 2023 the US Treasury sanctioned a representative of an already-sanctioned North Korean bank, saying he took in tens of millions in crypto and laundered it to support weapons production.

Mara: So a broker is the cash desk: coins in, spendable money out, quietly.

Eli: A cash desk with Chinese counters. China's financial systems and nationals are believed to be deeply involved, and crypto has paid for weapons deals and banned gold and copper. A US deputy national security adviser said in 2023 that cybercrime money funds at least half of the nuclear weapons program.

Mara: What's still held is contested. On data from Arkham Intelligence, North Korea's government was reported in 2025 to hold about 13,500 bitcoin. At the time, that was worth over a billion dollars, the third-largest government holding. Other trackers count about 800 bitcoin. Same country, a sliver of the size. Arkham, Elliptic, TRM Labs and Jenny Jun read large unlaundered reserves sitting on tracked wallets, because blacklisting and mixer sanctions make them hard to move.

Eli: The FBI, Fritz, Japan's foreign ministry, and TRM Labs here too, read it the other way: most stolen tokens get washed fast into cash, goods or stablecoins through brokers, because the state needs them now.

Mara: So the answer: North Korea doesn't mine bitcoin at scale. The mining Moriuchi caught in 2017 was real, but small and state-run, in a country short of power. The billions came from theft, and from people working American hours far from home.

Eli: And the cost lands on exchanges, developers and the companies whose payrolls ended up in Pyongyang.

Mara: Two things to watch. The tracked addresses from Bybit, Drift and Ronin: whether those dormant balances slide toward brokers or get frozen. And Pyongyang's IP ranges, for any real shift in mining. Until one of those moves, the biggest open number is the one still sitting in wallets.

Eli: Dig into IP address space.

Mara: And stay with us on technology.

Eli: That's all for this one. I'm Eli.

Mara: And I'm Mara. Thanks for listening to Angle. Until next time.