The cryptocurrency North Korea obtains is primarily stolen by hackers. It lacks any civilian applications; its main purpose is to launder the money and convert it into hard currency to circumvent sanctions. Common uses reported in public media include: Money laundering: Using coin mixers (Tornado Cash, Sinbad) and cross-chain bridges, the money is dispersed to numerous addresses. It is then exchanged for USD or RMB through OTC (over-the-counter) traders (mostly in Cambodia, China, and Southeast Asia). Funding weapons programs: A UN expert panel report estimates that a significant portion of the foreign exchange for North Korea's missile and nuclear programs comes from cryptocurrency theft. Purchasing supplies: After being converted into cash, it is used to buy sanctioned components, luxury goods, and oil. Making a network of hackers and IT workers: Overseas IT workers take on remote work under aliases, receive stablecoin salaries, and then remit them back to North Korea. Reinvesting in attacks: A portion of the money is used to purchase servers, domains, and fake identities to launch the next round of attacks. Notable examples include the theft of approximately $620 million from Ronin in 2022 and the theft of approximately $1.5 billion from Bybit in 2025, both of which were attributed to Lazarus.