Crypto Hacks Fuel Memes of North Korea: Blockchain’s Biggest Baddie

"Funding secured for next missile launch."

AccessTimeIconOct 12, 2022 at 7:53 p.m. UTC
Updated Oct 13, 2022 at 2:04 p.m. UTC
Layer 2
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global event for everything crypto, blockchain and Web3.Register Now

Seemingly every week in crypto yields another multimillion-dollar hack or exploit – and with it, reams of memes about North Korea, the supposed culprit.

The Hermit Kingdom’s alleged proficiency in pilfering billions of dollars from crypto protocols has spawned a new category of Kim Jong-Un-focused comedy on Crypto Twitter, the industry’s sometimes moldy water cooler. These memes cast North Korean hackers as master strategists dutifully draining decentralized finance (DeFi) in their race to nuke the world.

Jokes or no, they’re not entirely wrong. The Democratic People’s Republic of Korea (DPRK) has raided crypto exchanges, cross-chain token bridges and companies of over $1 billion in crypto this year alone, according to research firm Chainalysis.

These hacks have real-world implications: Officials have said the money helps fund North Korea’s nuclear weapons program. But in crypto, too, Kim’s shadow looms larger than ever: His hackers’ sloppy laundering of the Ronin hack through mixing service Tornado Cash led to the U.S. government’s first-ever sanctioning of a crypto protocol.

North Korea’s crypto heists stretch back to at least 2017. But it wasn’t until late 2020 that memesters started memorializing them, said DeGen Ping, a pseudonymous market commentator who riffs on Crypto Twitter.

“Then it revived with the Axie hack earlier this year,” Ping said in a Twitter message, referring to Axie Infinity. Now it’s full steam ahead: “People are waking up to the trend.”

The memesters aren’t waiting around for an official declaration of blame, Ping said. Now, every new hack and heist fosters new potential for fresh DPRK content. And there are a lot of hacks and heists from which to choose. One tongue-in-cheek bingo board suggests crypto suffers at least one colossal screwup a month.

“Nobody knows for sure but safe to assume [DPRK is behind it] until proven otherwise,” Ping said.

In the past seven days two episodes have sparked new DPRK memes: BNB Chain’s $500 million drain (a hack), and Solana-based DeFi exchange Mango Market’s $100 million loss (an exploit).

It may not be so far afield to drop the BNB heist at Kim’s feet; the incredible complexity that went into spoofing that Binance-linked blockchain suggests a state actor is at work. But the Mango drain, which saw an attacker manipulate the price of MNGO using tokens secured from a centralized (and thus know-your-customer compliant) exchange, is almost certainly not.

That made no nevermind for Crypto Twitter. In the hours following the heist some Crypto Twitterati speculated (using memes) that Lazarus Group hackers were to blame.

At the root of these memes may be the same weird mix of the professional and the grotesque that Will Gottsegen, CoinDesk's former culture reporter, says is the signature of Crypto Twitter.

“It's sort of like, both the dumbest and the most important platform in crypto,” he said.

On Crypto Twitter, traders can chase funding, influence, clout and fame by flaunting their wit, he said. Memes are a sort of currency in this space. DPRK offers a chance to relate crypto’s in-jokes to national security themes that actually matter to the world.

“In a way the DPRK memes are Crypto Twitter’s attempt at public intellectualism,” he said.

Ascribing such highfalutin themes to, well, s**tposting, isn’t accepted by all. One of the most prolific of these posters, the Twitter account for investor CMS Holdings, thinks the spate of North Korea memes is a function of people having literally nothing better to do.

“Think it's really just dull markets,” he said.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Danny Nelson

Danny is CoinDesk's Managing Editor for Data & Tokens. He owns BTC, ETH and SOL.

Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to to register and buy your pass now.