iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
On February 17, 2021, the U.S. Department of Justice announced charges against three North Korean programmers in a case alleging a wide-ranging cybercrime conspiracy. DOJ put the alleged value of theft and extortion involving financial institutions and companies at more than $1.3 billion. Separately, it described alleged bank-heist targeting of over $1.2 billion across four continents. Those figures have different scopes: the broader total was not all bank cash, and neither figure is a finding of proven losses.
The indictment accused Jon Chang Hyok, Kim Il, and Park Jin Hyok of participating in destructive cyberattacks, bank and cryptocurrency theft, extortion, malicious cryptocurrency applications, and a blockchain platform. An indictment is an accusation, not proof of guilt. The DOJ announcement and indictment describe the government’s allegations; they do not establish the defendants’ final court outcomes.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
![Under Suspicion [DVD]](https://m.media-amazon.com/images/I/41HVwCa4C-L._SL160_.jpg)
|
Under Suspicion [DVD] | $12.47 | Buy on Amazon |
| 2 |
|
Verbatim UltraLife Gold DVD-R 4.7GB Archival Grade, 50 Pack | $119.95 | Buy on Amazon |
What were the North Korean hackers charged with?
The indictment, filed in Los Angeles on December 8, 2020, alleged that the three programmers took part in a conspiracy that used cyberattacks to steal money, extort organizations, and support North Korean government revenue. DOJ said the defendants were members of units of North Korea’s Reconnaissance General Bureau. It also noted that cybersecurity researchers had used names including Lazarus Group and APT38 for activity attributed to the actors. Those labels describe threat-group attribution; they do not independently prove that any defendant committed the charged conduct.
The alleged activity was broader than bank transfers. Prosecutors described destructive attacks, efforts to steal from financial institutions, cryptocurrency theft, ATM cash-outs, malicious cryptocurrency applications, and a blockchain platform. The February 17, 2021 DOJ announcement summarizes the charges and the government’s account.
#1 Best Overall
What does the $1.3 billion figure mean?
The headline figure is DOJ’s estimate of more than $1.3 billion in alleged theft and extortion involving financial institutions and companies across the broader conspiracy. It is not a verified loss total and should not be read as $1.3 billion taken from banks.
| Figure | Scope and status |
|---|---|
| More than $1.3 billion | DOJ’s 2021 estimate of alleged theft and extortion from financial institutions and companies in the broader conspiracy. It was an allegation, not an adjudicated loss total. DOJ, February 17, 2021 |
| Over $1.2 billion | Bank-heist targeting across four continents, as described in Assistant Attorney General John C. Demers’s remarks. This is a narrower category than the broader theft-and-extortion figure. DOJ remarks, February 17, 2021 |
The amounts cover different categories of alleged conduct and should not be added together. Nor do they mean that every targeted transfer succeeded. DOJ’s 2021 account also included cryptocurrency theft and extortion, not just conventional bank-wire schemes.
How did the alleged bank heists work?
According to the indictment, attackers first installed malware and gained unauthorized access to a bank’s computer network. They allegedly moved through the network toward computers used to send or receive SWIFT messages—the instructions banks use to communicate international payment orders. The government said the attackers then used bank-specific malware to send fraudulent messages directing transfers to accounts they controlled, including accounts at U.S. federally insured financial institutions. Prosecutors also alleged that destructive malware was used to hide access, network routes, and fraudulent transfers.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The indictment described other methods as well, which should not be confused with SWIFT wire fraud:
- Cryptocurrency wallets: Prosecutors alleged that attackers accessed victim companies’ systems and wallets or private keys, then moved cryptocurrency to wallets they controlled.
- ATM cash-outs: The indictment alleged that malware manipulated transaction systems so ATMs dispensed cash to associates involved in laundering the proceeds.
These are the government’s descriptions of the alleged methods, not independently established findings about the defendants’ conduct. The filed indictment sets out the allegations in greater detail.
Rank #2
- 50 UltraLife Gold Archival discs featuring proprietary dual reflective layers; these discs are designed to last up to 100 years when properly stored
- Gold layer maximizes disc lifetime, protecting data from corrosion while silver layer provides high reflectivity and broad read/write compatibility
- 4.7GB/120 minute storage capacity - up to 16X write speed
- Advanced AZO recording dye optimizes read/write performance and Hard Coat protects discs from scratches extending media lifetime
- Verbatim has been a leader in data storage technology since 1969, and guarantees this product with a limited lifetime warranty and technical support
How the 2021 case built on the earlier Bangladesh Bank allegations
The 2021 indictment expanded a case DOJ had announced against Park Jin Hyok in 2018. In that earlier announcement, prosecutors alleged an $81 million theft from Bangladesh Bank in February 2016 and attempts to steal at least $1 billion through other bank operations from 2015 through 2018. The alleged Bangladesh Bank operation involved a compromised network and fraudulent SWIFT messages. These figures describe allegations from the 2018 case and should not be combined with the later $1.3 billion estimate as a single confirmed loss total.
DOJ’s account placed the accusations in a longer chronology:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors- November 2014: DOJ’s 2018 account attributed the attack on Sony Pictures Entertainment to the conspiracy following the release of The Interview.
- February 2016: Prosecutors alleged that $81 million was stolen from Bangladesh Bank using fraudulent SWIFT messages after the bank’s network was compromised.
- May 2017: DOJ connected the conspiracy to WannaCry 2.0, citing similarities in malware and shared infrastructure.
- September 6, 2018: DOJ announced charges against Park Jin Hyok.
- December 8, 2020: The expanded indictment was filed in Los Angeles.
- February 17, 2021: DOJ announced charges against Jon Chang Hyok, Kim Il, and Park Jin Hyok.
The 2018 figures and chronology come from the U.S. Attorney’s Office for the Central District of California.
What later DOJ actions say—and what they do not
In a 2025 announcement, DOJ described four alleged APT38 virtual-currency provider heists in 2023. The agency put the amounts at approximately $37 million, $100 million, $138 million, and $107 million, involving providers in Estonia, Panama, and Seychelles. DOJ also said two forfeiture complaints covered seized USDT valued at more than $15 million, and that tracing, seizure, and forfeiture work remained ongoing. These are later allegations and enforcement actions, not a disposition of the 2021 charges against the three named defendants. The amounts concern different matters and should not be added to the 2018 or 2021 figures as a verified total. See DOJ’s 2025 announcement.
In 2021, Acting U.S. Attorney Tracy L. Wilkison called the alleged conduct “extensive and long-running.” Assistant Attorney General John Demers described the operatives as “the world’s leading 21st century nation-state bank robbers.” Both were prosecutorial characterizations made while announcing an indictment, not court findings.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
