North Korea is believed to be stealing bitcoin from cryptocurrency exchanges, security researchers believe, in an attempt to get around tough new sanctions against the country.
At least three exchanges in South Korea have been targeted by state hackers since May say the security experts at FireEye.
Read more: Bitcoin and Ethereum are being hammered
"The spearphishing we have observed in these cases often targets personal email accounts of employees at digital currency exchanges, frequently using tax-themed lures and deploying malware (PEACHPIT and similar variants) linked to North Korean actors suspected to be responsible for intrusions into global banks in 2016," said researcher Luke McNamara in a blog post.
The move to cryptocurrencies follows previously identified state sanctioned cyber crimes last year and as the price of bitcoin rockets.
By hacking the exchanges, the state is able to move money around and swap it for hard currencies.
McNamara said it was "no surprise that cryptocurrencies, as an emerging asset class, are becoming a target of interest by a regime that operates in many ways like a criminal enterprise".