Between 2020 and mid-2021 cyber-attackers stole more than $50m (£37m) of digital assets, investigators found.
Such attacks are an "important revenue source" for Pyongyang's nuclear and ballistic missile programme, they said.
The findings were reportedly handed to the UN's sanctions committee on Friday.
The cyber-attacks targeted at least three cryptocurrency exchanges in North America, Europe and Asia.
