North Korea's illegal foreign currency earning operations have expanded into a new territory: illegal online gambling sites (casinos).
Instead of directly attracting customers to physical casinos, this business involves creating illegal online gambling sites, selling them to overseas criminal organizations, and even collecting fees for maintenance and management.
Even more shocking is the fact that South Korean cyber gambling criminal organizations were among the primary trading partners for these illegal gambling sites created by North Korean IT groups.
According to a synthesis of announcements by the National Intelligence Service (NIS), domestic and international media reports, and analysis from the Royal United Services Institute (RUSI) in the UK on the 20th, North Korea's illegal online gambling business has been revealed to go beyond simple program development, extending to foreign currency acquisition and the theft of personal information.
◇ North Korean Gambling Site Production Organization Based in Dandong, China
In February 2024, the National Intelligence Service disclosed the reality of illegal foreign currency earnings by 'Kyonghung Information Technology Exchange Company,' which was identified as being under the North Korean Workers' Party Office 39.
This organization, which operated out of Dandong, Liaoning Province, China, consisted of 15 North Korean IT personnel.
Investigations revealed that they accepted requests from domestic cyber criminal organizations to create illegal gambling sites and provided maintenance and management services.
In particular, it was revealed that they were involved in creating gambling sites targeting not only adults but also teenagers.
According to the NIS, this organization charged $5,000 per site for production.
After creating the site, they received a monthly maintenance and repair fee of $3,000, and demanded an additional $2,000 to $5,000 per month as the number of users increased.
It was a structure designed to continuously generate revenue rather than ending with the production and sale of a single site.
Assuming an exchange rate of 1,300 won per dollar at the time, the production cost is approximately 6.5 million won, and the monthly maintenance fee is approximately 3.9 million won.
When considering additional performance-based bonuses, the revenue the North Korean organization could earn increased the longer the site remained operational.
However, these were the terms of trade for a specific organization identified by the NIS and do not represent the average revenue or scale of North Korea's entire illegal online gambling business.
◇ Made with North Korean Technology, Operated by Domestic Organizations
A notable aspect of this case is the division of roles between the North Korean organization and the South Korean criminal syndicate.
The North Korean IT organization provided the technology to develop, maintain, and manage the online gambling sites.
The domestic criminal syndicate purchased these to utilize in their illegal gambling business.
The NIS stated that it is also investigating circumstances in which domestic criminal organizations that commissioned or traded for gambling site production with North Korean organizations earned trillions of won in revenue.
However, this does not mean that the entire revenue of the domestic criminal organizations was transferred to North Korea.
The foreign currency actually secured by the North Korean organization must be calculated based on verifiable transaction payments such as production costs, management fees, and additional bonuses.
The NIS identified that members of the Kyonghung Information Technology Exchange Company typically remitted $500 per person per month to Pyongyang.
This is a concrete example of North Korea's IT technology being combined with the illegal gambling market and used as a means of earning foreign currency.
◇ Malicious Code in Gambling Sites… Targeting Personal Information
What is even more concerning is that the North Korean organization did not stop at simply creating illegal gambling sites.
NIS investigations also revealed that in the process of maintaining and managing the sites, the North Korean IT organization used administrator privileges to collect members' personal information.
In particular, it was found that they inserted malicious code into programs that automatically process gambling bets to steal user information.
Circumstances were also captured where they attempted to build and sell a separate database of approximately 1,100 pieces of stolen South Korean personal information.
This means that users of illegal gambling sites are exposed to the additional risk of personal information leakage, beyond just financial loss.
The NIS also announced that it confirmed cases where servers provided by domestic criminal organizations to North Korean IT groups were misused to hack confidential information from South Korean companies.
The transactions for creating illegal gambling sites led to other cybercrimes.
◇ Receiving Foreign Currency via Borrowed-Name Accounts and Overseas Payment Networks
The methods used by North Korean IT organizations to receive illegal proceeds are also noteworthy.
According to the NIS, the organization was found to have received payments using bank accounts under Chinese names, borrowed-name accounts of domestic cyber gambling organizations, and overseas payment services.
Methods of cashing out funds at Chinese financial institutions and then bringing them into North Korea were also used.
This indicates that while North Korea is under international financial sanctions, it attempted to secure proceeds by utilizing external payment networks and accounts under other people's names.
In this process, it was also confirmed that North Korean IT personnel forged or stole Chinese identification cards to hide their identities.
The NIS analyzed that the number of North Korean personnel involved in such overseas IT foreign currency earning activities is likely significant.
However, there is no evidence that all North Korean overseas IT personnel participated in the development of illegal gambling sites.
◇ UK Research Institute Warns of North Korean Casino Money Laundering Risks
North Korea's online gambling-related activities are also attracting attention from international financial crime research institutions.
The Royal United Services Institute (RUSI) in the UK analyzed the issue of North Korea's online gambling site development and illegal fund flows in its report, 'North Korean Casino and Gaming Industry Activities and National Responses,' published in September 2024.
The report pointed out that North Korea has been generating revenue through the development and sale of online gambling sites since at least 2016.
In particular, it introduced the Kyonghung Information Technology Exchange Company case, disclosed by South Korea's NIS in 2024, as a major example.
RUSI emphasized the need for strengthened oversight regarding money laundering, sanctions evasion, and proliferation financing of weapons of mass destruction in an international financial environment where casinos, online games, and virtual assets are combined.
However, the report's risk analysis should not be interpreted as definitive proof that the proceeds from all casinos and gambling sites operated by North Korea were used directly for nuclear and missile development.
The study presents countermeasures for each country by distinguishing between actual confirmed illegal activities and the potential for abuse of financial systems.
◇ Tasks Left by North Korea's Online Gambling Foreign Currency Earnings
North Korea's offline casinos have a structure where revenue is generated only when foreign tourists visit in person.
However, the production of illegal online gambling sites differs in that they can trade with overseas criminal organizations without the need for tourists to enter the country.
In a structure where overseas IT personnel create programs and local criminal organizations take charge of operations, it is not easy to identify the parties trading with North Korea.
In particular, the fact that domestic criminal organizations use North Korean IT technology, which can lead to the leakage of users' personal information overseas or its misuse for hacking, further increases the dangers of illegal online gambling.
This is why it is necessary to track not only the blocking of illegal gambling sites and the arrest of operators but also the development, maintenance, and management organizations, as well as international payment networks.
Unless information sharing between relevant agencies, monitoring of financial transactions, and international investigative cooperation are strengthened, similar crimes may be repeated even if one site is shut down.
North Korean casinos have long been known as foreign currency earning facilities targeting foreign tourists.
However, the case disclosed by the NIS showed that North Korea-related IT organizations are also securing foreign currency in another area of the casino industry: the illegal online gambling market.
If the casinos in Pyongyang and Rason were businesses waiting for foreign tourists, the production of North Korea's illegal gambling sites is a method of earning foreign currency by selling technology to overseas criminal markets across borders.
The fact that South Korea's illegal gambling market and North Korean IT organizations were connected in this process is a task that domestic investigative agencies and financial authorities must continuously track.
