South Korea has imposed new sanctions on North Korean hackers responsible for stealing over $1 billion in crypto, with the illicit funds fueling the regime’s weapons programs.

The South Korean government has announced sanctions on the 313 Bureau, a North Korean cyber unit involved in widespread crypto theft. In a Dec. 26 public statement, the government noted that the bureau, which operates under the North Korean Ministry of National Defense, has been linked to numerous cyberattacks aimed at stealing digital assets from around the world.

South Korean officials cite data by U.S. blockchain analysis firm Chainalysis, which claims that North Korea is responsible for more than 60% of global crypto theft in 2024, totaling a record $1.3 billion. These stolen funds are believed to be funneled into North Korea’s weapons programs, including its missile and nuclear development initiatives.

In addition to targeting the 313 Bureau, the sanctions also cover 15 North Korean IT personnel and one related institution. The South Korean government says these individuals and organizations are accused of engaging in foreign currency-earning activities abroad, which directly contribute to the regime’s nuclear and missile programs.

“In particular, North Korean IT personnel, working under the Ministry of National Defense and other regime-affiliated organizations, are dispatched to countries in China, Russia, Southeast Asia, and Africa.”

South Korea’s Ministry of Foreign Affairs

The move comes just three days after crypto.news reported that the United States and South Korea are working together to create new mechanisms to prevent crypto thefts linked to North Korea.

The two countries have reportedly signed an agreement to jointly create technologies to stop crypto thefts. While details remain unclear, South Korea’s science ministry will also support the initiative through 2026. It is understood that researchers from both countries, including experts from Korea University and RAND Corp., will focus on tracking stolen crypto and preventing attacks. They will also investigate how criminals launder stolen funds into crypto using methods like ransomware.