--- title: "The Biggest Cryptocurrency Theft in History: How North Korean Hackers Pose as Recruiters and Where Billions Go" description: "North Korean hackers have reportedly stolen $6 billion in cryptocurrency. Estonia describes a scheme where attackers posed as recruiters to target IT specialists." date: 2026-11-13T15:21:56.328Z lang: en url: https://xab.info/en/posts/north-korean-hackers-cryptocurrency-theft tags: [north-korea, cybercrime, cryptocurrency, estonia, hacking, lazarus-group] author: "Roman V." publisher: "XAB.info" --- # The Biggest Cryptocurrency Theft in History: How North Korean Hackers Pose as Recruiters and Where Billions Go ![neon glowing microchip processor on a dark background cybersecurity](https://xab.info/media/2026/11/13/severokoreiskie-hakery-i-kraja-kriptovalyuty/severokoreiskie-hakery-i-kraja-kriptovalyuty-1.webp) ## Key Points - According to reports, hackers linked to North Korea have stolen approximately $6 billion in cryptocurrency. - Estonian IT specialist Tõnu Samuel received a job offer on LinkedIn on September 16 from someone posing as an AI company head in Dubai. - Experts from RIA and Glazer Technologies call this one of the North Korean hacker schemes tailored to the victim's profile. - Historically, attacks on Sony and SWIFT, as well as the WannaCry virus via the Lazarus Group, have been linked to the DPRK. - The primary goal of North Korean cyber operations today is regime funding and sanctions evasion, not ideology. In early November, news spread worldwide about the largest cryptocurrency theft in history: according to reports, hackers linked to North Korea stole crypto assets worth approximately $6 billion. Against this backdrop, in Estonia—one of the countries most vulnerable to cyber threats—experts explain how a sanctioned nation without free internet for the majority of its population turned into a hacker empire, and how even private IT specialists suffer from these schemes. The analysis shows that behind the loud figures lies years of conveyor-belt work where the main goal is not ideology, but money for the regime. ### A Dubai Recruiter Who Turned Out to Be a Hacker An illustration of this work was the case of 54-year-old Estonian computer expert Tõnu Samuel, a former hacker who has featured in various cyber-world stories over many years. It all started on September 16 when a certain Muhammad Raza wrote to him on LinkedIn, introducing himself as the head of an AI company living in Dubai and offering a job. Samuel recalls that the interlocutor first praised him and then moved on to describing a "project" featuring numerous terms. "If a person starts literally showering you with terms, then, as a rule, it is a scammer," he noted, calling this the first red flag. ### A Scheme Tailored to a Specific Victim Nikolai Kunitsõn, an analyst at the Estonian Information System Authority (RIA), explained that the essence of the fraudulent scheme is that it adapts to a specific person based on their profile and skills. According to him, Samuel rather quickly recognized the suspicious scheme and decided to play along with the attackers, allowing RIA to obtain more detailed information on how it all works. According to Kunitsõn and Ago Ambur, former head of the cybercrime bureau at the Police and Border Guard Board and now head of Glazer Technologies, this is one of the cyberattack schemes used by North Korean hackers. ### A Sanctioned Empire in Cyberspace North Korea is an unusual player on the international cyber scene: despite economic isolation and restricted internet access for the general population, the country possesses significant cyberattack capabilities. Kunitsõn notes the contrast: the DPRK's population is roughly 12–13 times larger than Estonia's, while its GDP is about a third or a quarter lower than Estonia's, yet it is a major player in cyberspace. According to Ambur's estimate, we are talking about hundreds of millions, and possibly billions of dollars annually, collected worldwide and then transferred back to the regime through various channels. ### From Sony and SWIFT to WannaCry Global attention to North Korean hackers was first drawn by a rather curious case: shortly before the premiere of the film The Interview, which mocked the dictatorship and an assassination attempt on the country's leader, hackers penetrated Sony's computer systems and leaked the company's internal correspondence. Two years later, according to Kunitsõn, an even larger-scale operation was carried out, exploiting a vulnerability in the SWIFT international interbank payment system; the hackers were exposed only due to a single typo, and as the investigation showed, without this error, they likely would have stolen over a billion dollars. Such operations are most frequently linked to the Lazarus Group, which, in particular, distributed the WannaCry ransomware that hit computers worldwide in 2017, including in Estonia. ### Why the Regime Needs Money Unlike China and Russia, which also possess powerful cyber espionage capabilities, North Korea, experts say, systematically uses cyberattacks specifically to steal money. While previously North Korean hackers' interest might have been predominantly ideological, today their main goal is making money, although the theft of secret data continues. Experts emphasize: as one of the most heavily sanctioned countries in the world, the DPRK bypasses international sanctions through its cyberspace activities, and the main task of such operations is funding the regime. ## Fact-Check & Sources - [Северокорейские хакеры пытались обмануть эстонского IT-специалиста под видом рекрутеров](https://rus.err.ee/1610195230/severokorejskie-hakery-pytalis-obmanut-jestonskogo-it-specialista-pod-vidom-rekruterov) - Confirmed facts include the attempted fraud against Tõnu Samuel via LinkedIn (Sept 16), statements by RIA analyst Nikolai Kunitsõn and Glazer Technologies head Ago Ambur, and historical context (Sony, SWIFT, WannaCry, Lazarus Group). The $6 billion figure is cited in the source as 'according to reports' without a named primary agency. ## FAQ ### How much have North Korean hackers reportedly stolen? In early November, news spread worldwide about the theft of approximately $6 billion in cryptocurrency; the source lists this figure as 'according to reports'. ### How did hackers try to contact the Estonian specialist? On September 16, a person posing as the head of an AI company in Dubai wrote to him on LinkedIn, offering a job and describing a 'project' with numerous technical terms. ### Why is North Korea important in cyberspace despite its isolation? Experts note that the DPRK systematically uses cyberattacks to steal money and evade sanctions to fund the regime; attacks on Sony and SWIFT and the WannaCry virus are linked to it.