The investigation is looking into the hack of a South Korean cryptocurrency exchange Youbit on Tuesday which led to its collapse.
Yapian, the company that operates Youbit, filed for bankruptcy after Tuesday’s attack.
People familiar with the situation said there are telltale signs and historical evidence that North Korea was behind the Youbit attack.
Senior director at the Korea Economic Institute in Washington, Troy Stangarone: “North Korea is an ideal country to use hacking and financial tools like bitcoin.
“They’re experimenting with ways to earn back lost money from sanctions.”
An investigation is underway, led by South Korean law enforcement and a state cybersecurity agency.
North Korean hackers targeted the same cryptocurrency exchange when it was operating under a different name in April it, has also been reported.
Officials in Seoul say they are keeping tabs on North Korea’s bitcoin-related activities, which analysts warn are being used to subvert international sanctions.
The announcement comes just days after sources in South Korean’s intelligence agency revealed North Korea was behind a hack on one of the the natin’s largest cryptocurrency exchanges earlier this year.
Baik Tae-hyun, a spokesman for the Unification Ministry, said: “We are continuing efforts to block North Korea’s hacking attempts.
“We are aware that North Korea have been engaged in various activities so far to evade sanctions and earn foreign currency.
We are monitoring North Korea’s trend related to bitcoin.”
A North Korean cyber army of 7,000 hackers around the world has changed tactics over the past two years.
It has been pilfering from banks and, more recently, focusing on cryptocurrencies, according to cybersecurity researchers.
North Korea has denied involvement in the hacking incidents.
Stealing bitcoin could be attractive to North Korea because of the huge increase of the value of the cyber currency in a relatively short period.
One bitcoin was worth under $1,000 at the start of the year and has surged to as high as nearly $20,000 this past weekend.
At least $7million (£5.25million) in virtual currency was stolen in the Bithumb hack in February.
But because of the surge in value of bitcoin and other cryptocurrencies, the amount is now said to be worth more than $82million.
Hackers also stole the personal information of around 30,000 people in the attack.
And they demanded a further $5.5million in exchange for deleting some of the information they had stolen.
Sources in the National Intelligence Service also suspect the North of being behind the hacking of another exchange, Coins, in September, the South Korean news agency Yonhap said.
Kim Jong-un has been ploughing money into his nuclear and ballistic missile programmes despite crippling economic sanctions which have blocked the export of the North’s biggest cash sources.
The latest, implemented in September, limit the import of oil and natural gas into the North and ban the sale of textiles.
President Donald Trump said he sanctions had been successful in isolating the hermit kingdom, but warned there was “much more work to do”.
Unveiling his national security strategy in Washington DC, he said: “Our campaign of maximum pressure on the North Korean regime has resulted in the toughest ever sanctions.
“We have united our allies in an unprecedented effort to isolate North Korea however there is much more work to do.
“America and its allies will take all necessary steps to achieve a denuclearisation and ensure that this regime cannot threaten the world.”