U.S., Japanese firms unwittingly hired North Korean animators: report

A soldier stands at a North Korean military guard post flying a national flag, seen from Paju, South Korea, June 26, 2024. (AP Photo/Lee Jin-man, File)

Major U.S. and Japanese animation studios including HBO Max and Amazon unknowingly hired North Korean IT workers, a joint government report has found.

Pyongyang has ramped up cyber operations in recent years, turning hacking into a key source of foreign currency in the face of biting sanctions over its nuclear and weapons programs.

A report released Wednesday by the multi-government Multilateral Sanctions Monitoring Team (MSMT) found that North Korean IT workers had concealed their nationality “in order to fraudulently gain contracts to work on animation projects for many companies”.

Those companies included “HBO Max, Amazon, and several Japanese animation studios”, the report found.

AFP has reached out to HBO Max and Amazon for comment.

Many of them worked for companies such as Pyongyang’s state-owned animation studio SEK studios -- previously reported to have assisted in Western projects such as the 2007 “Simpsons Movie”.

Almost 200 workers from the isolated country also “continued to perform animation work from China in 2024 and 2025”, the report said.

Under UN sanctions, North Korean workers are prohibited from earning money abroad.

The MSMT comprises Australia, Canada, France, Germany, Italy, Japan, the Netherlands, New Zealand, South Korea, the U.K. and the United States.

They found that cryptocurrency thefts -- along with arms sales to Russia -- made up the bulk of North Korea’s foreign earnings in 2024.

North Korea has secured crucial backing from Russia in recent years, after sending weapons and thousands of North Korean troops to fight alongside Moscow’s forces against Ukraine.

Pyongyang’s hackers looted at least US$1.19 billion from companies worldwide -- roughly 50 per cent more than a year earlier, according to the report.

Seoul’s intelligence agency last year said North Korean operatives had used LinkedIn to pose as recruiters and approach South Koreans working at defence firms to obtain information on their technologies.

Although the overwhelming majority of North Korea’s overseas IT workers were based in China, the participating states of the report said they found Pyongyang “planned to dispatch a new deployment of 40,000 laborers to Russia, including several delegations of IT workers”.

Between January and September this year, North Korean hackers have already taken at least $1.65 billion through large-scale crypto heists, “surpassing estimates of its 2024 total”, it added.

And from January 2024 to September 2025, North Korea stole at least $2.8 billion in cryptocurrency, it said.