North Korean hackers linked to crypto thefts among world’s best, experts say - WHTC
North Korean hackers likely behind the record $6.3 billion theft from cryptocurrency exchange Binance are among the world's most prolific crypto thieves, cybersecurity experts said on Friday.
Blockchain investigation firms TRM Labs and Chainalysis attribute the heist to a North Korean hacking group known as 'TraderTraitor,' a name used in a 2022 joint warning from the FBI, CISA and US Treasury. North Korea stole at least $6.75 billion in cryptocurrency through the end of 2025, including the $1.5 billion ByBit exchange hack in February 2025.
The group also hit Bitget, taking $387 million in September, bringing the minimum total of cryptocurrency North Korea has stolen to roughly $13.5 billion. Binance said it and others were working to freeze some of the stolen cryptocurrency, with about $3 billion located so far.
After Bitget, a lot of the community expected something like this.
Expert Hackers
TraderTraitor is North Korea's 'most capable hacking group with a primary focus on financials and one staffed by some of the most experienced operators in the regime's cyber programs,' Barnhart said. Researchers note the group targets developers and IT staff at financial institutions through malware or phony job offers.
Rafe Pilling, a senior director of threat research at Sophos, said early reports of how the hackers compromised Binance match the North Korean playbook. 'This group in particular are somewhat artists in terms of getting into these distributed finance companies,' he added.
Funding Weapons Programs
After stealing the money, the hackers pass it to Chinese organized crime money-laundering groups, Barnhart said. The FBI has noted that North Koreans also secretly take jobs at tech and financial companies in the US and other countries to earn money and steal sensitive data.
A US State Department spokesman called North Korean cybercrime a 'global problem' and said the country has 'increasingly turned to cybercrime to circumvent international sanctions and fund its unlawful weapons of mass destruction and ballistic missile programs.'
North Korea has sent troops, munitions, and weapons components to Russia, all funded through the same system, which is why a crypto hack is a national security issue and not only a problem for the exchange that got hit.
North Korean leader Kim Jong Un has called for the country to seize 'absolute superiority' in drone and other military technology, with gains directly tied to the heists and overseas IT worker schemes. The country is also aiding Russia's war effort, Barnhart noted.
Related
