> ## Content Index
> Fetch the complete content index at: https://johnwlittle.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Covert Contact 91: North Korean Cryptocurrency Ops
- URL: https://johnwlittle.com/north-korean-cryptocurrency-ops/
- Published: 2018-01-10T05:36:55.000Z
- Updated: 2026-10-17T01:01:56.000Z
- Description: Scot Terban joins me to discuss North Korea’s reported cryptocurrency activity, exchange security, illicit mining, and the difficulty of following digital funds. We also examine attribution and the technology’s wider implications for intelligence operations.
- Author: John Little
- Tags: Covert Contact, Technology, Cryptocurrency, Russia, Scot Terban, North Korea

Security researcher [Scot Terban](https://krypt3ia.wordpress.com/?ref=johnwlittle.com) joins me to examine North Korea’s interest in cryptocurrency and the opportunities a rapidly expanding financial system can offer a state under sanctions. Our conversation looks at the activity being reported around the turn of 2018, from attacks on exchanges to ransomware proceeds, while also considering how difficult it can be to attribute an operation with confidence.

We discuss why exchanges and their employees can be attractive targets. A growing market brings new services, large concentrations of funds, and uneven security practices. Scot describes reports of phishing directed at personal email accounts and malware associated with attacks on South Korean exchanges. We also examine unauthorized mining, where compromised computing resources can generate cryptocurrency, and consider other ways a state-backed operation might exploit weaknesses in the surrounding market.

The conversation then turns to tracking money. Different currencies and systems offer different degrees of transparency, and moving between them can complicate an investigation. We discuss the distinction between cryptocurrency’s legitimate uses and the opportunities it presents for financial crime. Some blockchain designs can support transparency and compliance; others place a greater emphasis on privacy. Those choices matter to governments, investigators, and users alike.

Attribution remains a recurring caution. Scot discusses the public attribution of WannaCry to North Korea, the limits of interpreting technical indicators, and questions about how that attack unfolded. We explore possibilities for further illicit activity without treating every plausible scenario as a documented North Korean operation.

Finally, we consider how the same technology could serve intelligence operations, including moving funds to people abroad. That brings the discussion back to a broader challenge: intelligence services and law enforcement need to understand an evolving ecosystem whose tools can create opportunities for both investigators and their targets. The question extends well beyond any single exchange theft or currency.