Tracked by SecureWorks Counter Threat Unit researchers as a subgroup of a larger North Korean cluster the unit calls Nickel Academy, Nickel Gladstone is assessed with high confidence to focus on acquisitive financial crime against financial institutions and online criminal activity for financial gain. This focus broadens its geographic scope beyond other North Korean groups to organizations across the Americas, Europe, Africa, and Asia, with particular interest in countries with weaker financial regulatory regimes. Nickel Gladstone rose to prominence in February 2016 with Bangladesh Central Bank's loss of eighty-one million dollars through fraudulent SWIFT messages, and it subsequently conducted similar operations against banks in Vietnam, Ecuador, Taiwan, Chile, and India, and was likely responsible for compromising the Polish Financial Supervision Authority website in 2017. Since at least 2018 it has increasingly targeted cryptocurrency exchanges and decentralized finance organizations using applications that mimic legitimate trading platforms to steal wallet contents, including a later campaign aimed at blockchain-research employees. Its custom malware shows strong ties to earlier North Korean operations, including Operation Blockbuster and the Sony Pictures intrusion.