Lazarus, a North Korean hacking group, has been linked to attacks and other security breaches on the cryptocurrency exchanges in South Korea, US cybersecurity firm Recorded Future has confirmed. It was the same type of malware used in the WannaCry ransomware attack on Sony pictures, as well as the South Korean cryptocurrency exchange Coinlink.

Bithumb, which is the second largest cryptocurrency exchange in SK, was hit in February 2017, and $7m (mostly from Bitcoin and Ether) in user losses was recorded. Lazarus have many advanced tools to help them steal money from cryptocurrency accounts, and hackers from North Korea have concentrated their efforts on the spread of malware through attachments.

One method of spreading the malware was through Hangul Word Processor (HWP) files attached to emails. These files are the South Korean equivalent of Word files, and they were used to contain the malware. Once a cryptocurrency user downloads it, it secretly installs itself and begins to operate in the background. It then takes control or alters the stored data on a particular device.

North Korea began its own cryptocurrency mining ops in 2017, and the first operation happened in February. By the end of the year, reports had confirmed the spear phishing thefts against South Korea.