The blockchain advisory
The FBI, CISA and U.S. Treasury's April 2022 TraderTraitor advisory describes North Korean state-sponsored actors targeting blockchain and cryptocurrency organizations. It identifies social engineering and malicious applications as parts of the campaign. The advisory's operational account is more useful for understanding the threat than assuming every stolen dollar can be traced directly to one missile.
Source [1]Keep the funding claims and totals in context
An earlier U.S. government FASTCash advisory linked North Korean financial theft to evasion of sanctions and revenue supporting prohibited nuclear and ballistic-missile programs. Its bank-theft figures are not interchangeable with an annual estimate of cryptocurrency stolen from exchanges. Different reporting periods, targets and definitions produce different totals. A sound comparison must identify which assets, incidents and dates are included. The linked Twitch report illustrates a different kind of exposure: leaking source material or payout information is not automatically the same as stealing funds. These historical advisories explain the reported methods and government assessment without claiming a complete transaction-by-transaction accounting of a weapons program.
Source [2]