North Korea as the perpetual hacker state? — Phar Kim Beng

October 31 — North Korea's emergence as a suspect in a $6.3 billion cryptocurrency heist involving Binance underscores the growing importance of cyber operations in its national security strategy. This development goes beyond the mere loss of funds; it raises concerns about cyber theft becoming a regular tool for state financing and strategic competition.

The implications for international security are far-reaching, particularly when a sanctioned state like North Korea can generate billions through cyber operations without crossing any borders.

Unlike traditional military actions, cyberattacks can be executed repeatedly, discreetly, and across borders. North Korea is suspected of perpetrating a series of cryptocurrency heists, including a $1.5 billion theft from Bybit in February 2025. This suggests that digital financial theft may be an enduring aspect of Pyongyang's external operations.

While ordinary cybercrime is primarily driven by personal gain, state-sponsored operations often aim to achieve broader strategic goals, such as circumventing sanctions, gathering intelligence, or securing resources for national programs. For North Korea, digital assets present opportunities not accessible through conventional financial channels due to stringent international restrictions.

Cryptocurrency transactions, though decentralized and challenging to trace, are not entirely immune to detection. Blockchain analytics, international enforcement, and asset freezes can sometimes disrupt illicit flows. However, the decentralized nature of cryptocurrencies and the sophistication of cybercriminals and state-linked operators pose significant challenges.

Artificial intelligence further complicates the situation by enabling more advanced techniques such as phishing, impersonation, reconnaissance, and social engineering, which can enhance the speed and effectiveness of cyber operations. Even the strongest cryptographic defenses can be compromised if the personnel or administrative systems of an exchange are targeted.

The impact of a major cyber breach extends far beyond cryptocurrency investors. As digital assets become more integrated into mainstream banking, payment systems, and institutional investment, a significant breach could lead to broader financial instability. For Southeast Asian nations, the rise of digital financial ecosystems presents both opportunities and risks.

Malaysia, Singapore, Indonesia, Thailand, and other Asean economies must balance innovation with robust cybersecurity measures, effective supervision, and enhanced regional intelligence-sharing.

Cooperation with South Korea, which has extensive experience in monitoring cyber threats from North Korea, could bolster regional capacity-building without delving into military conflicts. Ultimately, North Korea's suspected cryptocurrency activities exemplify a broader shift in international security. Economic warfare is no longer confined to physical blockades or financial institution seizures but can now occur through compromised networks, stolen credentials, and manipulated digital infrastructure.

The concept of the "perpetual hacker state" is not solely applicable to North Korea; it represents a strategic model that other malicious actors might seek to adopt. As long as cyber operations offer substantial rewards with relatively low costs, the incentive for repeated attacks will persist. To address this challenge, the international community must make such operations more difficult to execute, easier to detect, and more costly to sustain.

Protecting digital systems through which money moves is crucial for financial security in the digital age.