DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

NiceHash

Date (as written)
2017-12
Year
2017
Country
Slovenia
Actors (as written)
Bluenoroff
Actor pages
Bluenoroff
Tags (as written)
FinancialGain Cryptocurrency
Dollar figures (as written)
$65,000,000; 70+M USD; 63.92M USD; 65m; $75 million

Source entries (6)

lazarus.day

NiceHash · 2017-12
NiceHash was described as a cryptocurrency-mining marketplace theft linked to Hidden Cobra, with the intrusion beginning through social engineering that impersonated a company system engineer and mimicked a Google Docs weekly-report invitation sent via an anonymous email service. Later indictment reporting tied the incident to North Korean RGB military hacking units known in security reporting as Lazarus Group and APT38, within a broader campaign of financial theft, cryptocurrency operations, and laundering of cyber-enabled proceeds.
https://lazarus.day/incidents/nicehash/

tayvano/lazarus-bluenoroff-research

NiceHash · 2017-12-06
Amt Stolen: $65,000,000
https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/nicehash.md

UN Panel of Experts S/2019/691

Reported theft of 70+M USD from the bitcoin mining company, NiceHash, which reported "a highly professional · Dec 2017
Annex 21: Suspected DPRK cyber-attacks on financial institutions (including banks and cryptocurrency exchanges) investigated by the Panel. B. Cryptocurrency. Reported theft of 70+M USD from the bitcoin mining company, NiceHash, which reported "a highly professional attack with sophisticated social engineering" that resulted in approximately 63.92M USD of Bitcoin being stolen.
https://undocs.org/S/2019/691

UN Panel of Experts S/2024/215

NiceHash · December 2017
Annex 95: Suspected DPRK cyberattacks on cryptocurrency-related companies (2017-2023) investigated by the Panel. Table 2017: Victim: NiceHash; Date: December; Amount (USD equivalent): 65m; Location: Slovenia
https://undocs.org/S/2024/215

US DOJ press release 2021-02-17 (Jon Chang Hyok, Kim Il, Park Jin Hyok indictment)

Slovenian cryptocurrency company · December 2017
Targeting of Cryptocurrency Companies and Theft of Cryptocurrency: ... including $75 million from a Slovenian cryptocurrency company in December 2017
https://www.justice.gov/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

NiceHash · 2017-12
Reported: 2017-12; Victims: NiceHash; Motivations: FinancialGain; Sectors: Cryptocurrency; Countries: Slovenia
https://data.mendeley.com/datasets/wwb2rzgfn7/2

Suggest a correction on GitHub