The isolated, secretive and autocratic country is largely cut off from the world’s economic system – but when it comes to generating foreign earnings it relies on some of the world’s most sophisticated hacking. Experts, such as TRM Labs, quickly attributed the extraordinary $6.3bn (£4.7bn) Binance cryptocurrency theft to TraderTraitor, an elite North Korean hacking unit that has also been known as the Lazarus Group. Though the link may not be proven yet, the pattern of behaviour is familiar.
North Korea has a history of cryptocurrency theft dating back to 2017, focusing on the sector’s relatively lax security controls as a way of stealing money and generating revenues for its military, including its nuclear weapons programme. Kim Jong-un, its dictatorial ruler, controls a stockpile of about 50 nuclear warheads, and has been supplying troops and weapons to help Russia in its war in Ukraine. But North Korea is also extremely poor: 40% of the population are undernourished according to the UN and nearly one in five of its children are stunted.
A UN panel of experts, reporting to the security council, said in the spring of 2024 that it was reviewing “58 suspected cyber-attacks” by North Korea “on cryptocurrency-related companies between 2017 and 2023” worth $3bn. The panel said the cash was estimated to generate half of North Korea’s foreign currency income. One unnamed country went further with its estimate: the stolen billions fund “40% of the weapons of mass destruction programmes”.
The suspected crypto hacks amounted to as many as 17 in 2023 alone: thefts valued at $750m, and disturbingly, the sums involved are only increasing. The world’s largest previous crypto hack took place in February 2025, when $1.5bn was stolen from the Bybit exchange – the work, the FBI said, of TraderTraitor. Ciaran Martin, a former head of the UK’s National Cyber Security Centre, argues that North Korea appears to have targeted crypto because traditional banks have developed sophisticated defences that the fast-growing and lightly regulated sector has yet to match.
The number of traditional banks who have suffered a loss of more than $100m as a result of a cyber-attack in the same period is zero or one,” Martin said. North Korea was behind one of the last large cyber thefts on a traditional bank – an attack on Bangladesh Bank in February 2016, where North Korean hackers tried to illicitly move $951m from an account the bank had with the Federal Reserve Bank of New York, taking advantage of time differences between the two. A piece of luck prevented most of the money from being sent to an intermediate account in the Philippines.
The corresponding bank was based on Jupiter Street, which shares its first word with the name of a sanctioned Iranian ship, so most of the transfers were held up. In the end, $81m was stolen. The isolated state has long been accused of engaging in criminal activities to survive, including the forgery of high-quality $100 bills, known as “supernotes” in the 1990s, and the production and trafficking of crystal meth for export in the 2000s.
Extract — continue reading at the source.
