US Justice Department Seizes $500K in Ransom Payments and Crypto From North Korean Hackers

Deputy Attorney General Lisa Monaco said the FBI has identified a new type of ransomware used by the state-sponsored hackers.

By Elizabeth Napolitano

Jul 19, 2022 at 3:36 p.m. UTC

Updated Jul 19, 2022 at 4:48 p.m. UTC

Elizabeth Napolitano

Elizabeth Napolitano is a news reporter at CoinDesk.

Follow @LizKNapolitano on Twitter

The U.S. Justice Department has seized about $500,000 in ransom payments and cryptocurrencies from North Korean government-backed hackers, U.S. Deputy Attorney General Lisa Monaco said in a speech at Fordham University in New York on Tuesday.

U.S. officials believe the hackers either extorted the money from U.S.-based health care organizations or used the money to launder ransom payments.
The North Korean hackers targeted medical providers in Kansas and Colorado last year, encrypting computer systems that operated key equipment, Monaco said. The incidents came to the attention of U.S. officials when an unnamed medical provider in Kansas reported them to the FBI.
The Kansas complaint helped the FBI identify a new type of ransomware used by the North Koreans and allowed the bureau to seize ransom payments and cryptocurrencies from China-based money launderers hired by the North Koreans, according to Monaco. She urged other U.S. organizations and companies to report similar incidents to the FBI.
The seizures were aided by investments that the FBI, Secret Service and Treasury Department have made in tracking crypto payments to cybercriminal groups, according to Monaco.
Earlier this year, the FBI assembled a new task force of cryptocurrency experts that focuses on blockchain analysis and digital money seizures.
In March, the U.S. government linked North Korean state-sponsored hacker Lazarus Group to a $625 million theft of cryptocurrency from the Ronin bridge linked to popular play-to-earn game Axie Infinity.

UPDATE (July 19, 20:48 UTC): Took 'Report' out of the headline and linked to Monaco's speech in the first paragraph.

Read more about

North Korea Ransomware FBI US

DISCLOSURE

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.