In early November, news spread worldwide about the largest cryptocurrency theft in history: according to reports, hackers linked to North Korea stole crypto assets worth approximately $6 billion. Against this backdrop, in Estonia—one of the countries most vulnerable to cyber threats—experts explain how a sanctioned nation without free internet for the majority of its population turned into a hacker empire, and how even private IT specialists suffer from these schemes. The analysis shows that behind the loud figures lies years of conveyor-belt work where the main goal is not ideology, but money for the regime.
A Dubai Recruiter Who Turned Out to Be a Hacker
An illustration of this work was the case of 54-year-old Estonian computer expert Tõnu Samuel, a former hacker who has featured in various cyber-world stories over many years. It all started on September 16 when a certain Muhammad Raza wrote to him on LinkedIn, introducing himself as the head of an AI company living in Dubai and offering a job. Samuel recalls that the interlocutor first praised him and then moved on to describing a "project" featuring numerous terms. "If a person starts literally showering you with terms, then, as a rule, it is a scammer," he noted, calling this the first red flag.
A Scheme Tailored to a Specific Victim
Nikolai Kunitsõn, an analyst at the Estonian Information System Authority (RIA), explained that the essence of the fraudulent scheme is that it adapts to a specific person based on their profile and skills. According to him, Samuel rather quickly recognized the suspicious scheme and decided to play along with the attackers, allowing RIA to obtain more detailed information on how it all works. According to Kunitsõn and Ago Ambur, former head of the cybercrime bureau at the Police and Border Guard Board and now head of Glazer Technologies, this is one of the cyberattack schemes used by North Korean hackers.
A Sanctioned Empire in Cyberspace
North Korea is an unusual player on the international cyber scene: despite economic isolation and restricted internet access for the general population, the country possesses significant cyberattack capabilities. Kunitsõn notes the contrast: the DPRK's population is roughly 12–13 times larger than Estonia's, while its GDP is about a third or a quarter lower than Estonia's, yet it is a major player in cyberspace. According to Ambur's estimate, we are talking about hundreds of millions, and possibly billions of dollars annually, collected worldwide and then transferred back to the regime through various channels.
From Sony and SWIFT to WannaCry
Global attention to North Korean hackers was first drawn by a rather curious case: shortly before the premiere of the film The Interview, which mocked the dictatorship and an assassination attempt on the country's leader, hackers penetrated Sony's computer systems and leaked the company's internal correspondence. Two years later, according to Kunitsõn, an even larger-scale operation was carried out, exploiting a vulnerability in the SWIFT international interbank payment system; the hackers were exposed only due to a single typo, and as the investigation showed, without this error, they likely would have stolen over a billion dollars. Such operations are most frequently linked to the Lazarus Group, which, in particular, distributed the WannaCry ransomware that hit computers worldwide in 2017, including in Estonia.
Why the Regime Needs Money
Unlike China and Russia, which also possess powerful cyber espionage capabilities, North Korea, experts say, systematically uses cyberattacks specifically to steal money. While previously North Korean hackers' interest might have been predominantly ideological, today their main goal is making money, although the theft of secret data continues. Experts emphasize: as one of the most heavily sanctioned countries in the world, the DPRK bypasses international sanctions through its cyberspace activities, and the main task of such operations is funding the regime.
