On February 17, 2021, the U.S. Department of Justice announced charges against three North Korean programmers in a case alleging more than $1.3 billion in theft and extortion from financial institutions and companies. That headline figure is broader than the alleged bank heists: DOJ separately described bank-heist targeting of over $1.2 billion across four continents. Both are allegations in an indictment, not verified losses or findings of guilt.
What were the North Korean hackers charged with?
The indictment charged Jon Chang Hyok, Kim Il, and Park Jin Hyok with participating in a broad conspiracy involving destructive cyberattacks, bank and cryptocurrency theft, extortion, malicious cryptocurrency applications, and a blockchain platform. DOJ said the three were members of units of North Korea’s Reconnaissance General Bureau. Cybersecurity researchers have used labels including Lazarus Group and APT38 for activity attributed to the operation; those labels are not proof of the defendants’ guilt. DOJ’s February 17, 2021 announcement describes the charges.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
![Under Suspicion [DVD]](https://m.media-amazon.com/images/I/41HVwCa4C-L._SL160_.jpg)
|
Under Suspicion [DVD] | $12.51 | Buy on Amazon |
| 2 |
|
Verbatim UltraLife Gold DVD-R 4.7GB Archival Grade, 50 Pack | $119.95 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
The indictment was filed in Los Angeles on December 8, 2020, and expanded a case DOJ had announced against Park Jin Hyok in 2018. An indictment is an accusation, not proof of guilt. The available DOJ announcements do not establish the individual court dispositions of all three defendants.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhat does the $1.3 billion figure mean?
The figures describe different scopes of alleged conduct, so they should not be treated as interchangeable or added together as a verified loss total.
#1 Best Overall
| Figure | What DOJ said it measured | Source and status |
|---|---|---|
| More than $1.3 billion | Alleged theft and extortion involving financial institutions and companies in the broader conspiracy | DOJ, 2021; allegation in the indictment and announcement |
| Over $1.2 billion | Bank-heist targeting across four continents | DOJ remarks, 2021; description of alleged targeting |
The $1.3 billion was not described as cash stolen solely from banks. The broader conspiracy also included alleged extortion and cryptocurrency-related crimes. The narrower $1.2 billion figure concerns bank-heist targeting, not a confirmed amount successfully transferred or retained. Assistant Attorney General John Demers’s remarks provide the separate bank-heist characterization.
How did the alleged bank heists work?
According to the indictment, the alleged wire-transfer scheme began with malware and unauthorized access to a bank’s computer network. The hackers allegedly moved through the network to computers involved in sending or receiving SWIFT messages, then used bank-specific malware to issue fraudulent messages directing transfers to accounts they controlled, including accounts at U.S. federally insured financial institutions. The indictment also alleges that destructive malware was used to obscure access, network paths, and fraudulent transfers. These are the government’s allegations about the method, not a finding by a court. The filed indictment sets out the alleged operations.
Cryptocurrency theft was a separate method
The indictment separately alleges that the hackers accessed companies’ systems and cryptocurrency wallets or private keys, then transferred cryptocurrency to wallets under their control. That is distinct from sending fraudulent SWIFT wire instructions.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ATM cash-outs were another alleged scheme
In a separate alleged operation, malware manipulated transaction systems so ATMs dispensed cash to associates involved in laundering the proceeds. This cash-out method should not be collapsed into the bank-wire or cryptocurrency-wallet allegations.
Rank #2
- 50 UltraLife Gold Archival discs featuring proprietary dual reflective layers; these discs are designed to last up to 100 years when properly stored
- Gold layer maximizes disc lifetime, protecting data from corrosion while silver layer provides high reflectivity and broad read/write compatibility
- 4.7GB/120 minute storage capacity - up to 16X write speed
- Advanced AZO recording dye optimizes read/write performance and Hard Coat protects discs from scratches extending media lifetime
- Verbatim has been a leader in data storage technology since 1969, and guarantees this product with a limited lifetime warranty and technical support
How the case developed
- November 2014: DOJ’s 2018 account says the conspiracy attacked Sony Pictures Entertainment after the release of “The Interview.”
- February 2016: DOJ alleged that $81 million was stolen from Bangladesh Bank using fraudulent SWIFT messages after the bank’s network was compromised.
- May 2017: DOJ linked the conspiracy to WannaCry 2.0 based on similarities in malware and shared infrastructure.
- September 6, 2018: DOJ announced charges against Park Jin Hyok. It alleged an $81 million Bangladesh Bank theft in 2016 and attempts to steal at least $1 billion in other bank operations from 2015 through 2018. The 2018 DOJ announcement describes those earlier allegations.
- December 8, 2020: The expanded indictment was filed in Los Angeles, according to DOJ’s 2021 announcement.
- February 17, 2021: DOJ announced charges against Jon Chang Hyok, Kim Il, and Park Jin Hyok.
The $81 million Bangladesh Bank allegation and at-least-$1-billion estimate of attempted theft are from DOJ’s 2018 account; they are not additional confirmed losses to add to the later $1.3 billion figure.
What DOJ reported after the 2021 charges
In a 2025 announcement, DOJ described later allegations involving APT38-related virtual-currency activity. It said four alleged 2023 heists involving providers in Estonia, Panama, and Seychelles involved approximately $37 million, $100 million, $138 million, and $107 million, respectively. The approximate amounts total about $382 million, but they concern later allegations and are not part of the 2021 indictment’s figures.
DOJ also said two forfeiture complaints covered seized USDT valued at more than $15 million, and that tracing, seizure, and forfeiture work remained ongoing. These subsequent enforcement actions do not establish the outcome of the 2021 case against the three named defendants. DOJ’s 2025 announcement describes the later matters.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
