Kim Jong-un

Kim Jong-un has led North Korea since December 2011. Under his leadership, the state has pursued nuclear and missile programmes while adapting its revenue system to extensive United Nations and national sanctions. Kim is directly connected to declared national strategy. Specific cyber thefts, overseas-worker schemes and transactions, however, must be attributed to the organs or networks identified by the relevant evidence rather than assigned to him personally.

Strategy under sanctions

The Workers' Party's March 2013 byungjin line called for parallel economic construction and nuclear development. Nuclear and missile tests during 2016 and 2017 were followed by stronger United Nations measures covering sectors including coal, textiles, seafood, overseas labour and fuel. Those measures form part of the continuing United Nations sanctions regime against North Korea (2006-present), administered through the Security Council's 1718 Committee.

DPRK entities adapted through concealed trade, ship-to-ship transfers, overseas labour and digital revenue activity. The final UN Panel of Experts report, issued in March 2024, described investigations into suspected cyberattacks between 2017 and 2023 and reported assessments linking cyber proceeds to prohibited programmes. The Panel's mandate ended on 30 April 2024. The 1718 Committee and sanctions measures did not end with it. The separately established Multilateral Sanctions Monitoring Team now publishes assessments, including on cyber activity and overseas information-technology workers.

Diplomacy and attribution

Kim's summit diplomacy in 2018 and 2019 connected sanctions relief to negotiations over the nuclear programme. The Hanoi summit ended without agreement after the parties differed over the scope and sequence of relief and denuclearisation. North Korean policy later returned to stronger self-reliance language and expanded relations with Russia.

Government and multilateral reports attribute cryptocurrency theft and remote-worker schemes to DPRK-linked actors. Those assessments support analysis of cryptocurrency theft and IT-worker revenue schemes, but they do not establish Kim's personal direction of each act. Nor do they establish that every overseas worker knowingly participated in deception.

Significance

Kim is simultaneously a sender of state policy, a target of external restrictions and an institutional adapter. The case demonstrates how a highly centralised government can combine negotiation, evasion and asymmetric revenue tools under pressure. It also shows the limits of leader-centred attribution: strategic responsibility at the top does not remove the need to prove the operational chain below it.

See also

North Korea · North Korean cryptocurrency theft campaign (2017-present) · North Korean remote IT-worker revenue schemes (2022-present) · United Nations sanctions regime against North Korea (2006-present) · Office 39 · Economic statecraft

Sources

• United Nations Security Council, 1718 Committee, mandate and sanctions measures.
• United Nations Security Council, final report of the Panel of Experts, S/2024/215 (7 March 2024).
• Multilateral Sanctions Monitoring Team, *The DPRK's Violation and Evasion of UN Sanctions through Cyber and Information Technology Worker Activities* (2025).
• Workers' Party of Korea, report of the March 2013 plenary meeting, as reproduced by KCNA Watch (31 March 2013).