Deepfakes and an elite hacker school: How cybercrime is growing as a source of income for North Korea

China is the world’s leading promoter of cybercrime, according to all reports. But there is a small Asian country that is steadily gaining importance in this industry: North Korea. The hermetic state, strangled by trade embargoes, has found its main source of foreign currency in online criminal activity. Analysts agree that the structure of the hacker groups allegedly funded by Pyongyang is growing in complexity: specialized groups are being created for different types of cyberattacks, coordinating with each other. They also emphasize that their techniques are becoming increasingly sophisticated. Incidents linked to North Korea increased by 130% in 2025 compared to the previous year, according to a recent CrowdStrike report. These included the theft of $1.46 billion worth of cryptocurrency from the Bybit platform, considered the largest cyber heist in history.

Countries such as China, Russia, Iran, Israel, and the U.S. unofficially sponsor teams of hackers to carry out sabotage or obtain valuable information. They are useful for conducting covert operations, as it is extremely difficult to attribute authorship of incidents in the cyber arena. Pyongyang’s case is different: it uses its group of computer experts, known by the codename Lazarus, not so much for intelligence gathering as for making money.

The Beloved and Respected Leader — one of the official ways of referring to Kim Jong-un — beckoned years ago to cybercrime as a source of income to help him survive international sanctions imposed on his country. “Despite improved trade relations with Russia, the Democratic People’s Republic of Korea [North Korea’s official name] needs additional revenue to finance its ambitious military plans, which include building new destroyers, manufacturing nuclear-powered submarines, and launching new reconnaissance satellites,” states the CrowdStrike report.

Read more at El Pais