North Korean hackers linked to crypto thefts among world's best, experts say - The Hindu
North Korean hackers likely behind the record $6.3 billion theft from cryptocurrency exchange Binance are among the world's most prolific crypto thieves, with proceeds funding the country's weapons programs, cybersecurity experts said.
Blockchain investigation firms TRM Labs and Chainalysis attribute the heist to a North Korean hacking group known as "TraderTraitor," a name used in a 2022 joint warning from the FBI, CISA and US Treasury that described how hackers used malicious software and other tricks to target software developers and IT staff at cryptocurrency companies.
North Korea stole at least $6.75 billion in cryptocurrency through the end of 2025, Chainalysis said in a December 2025 report. That total includes the $1.5 billion ByBit exchange hack in February 2025.
The group also hit Bitget, a separate exchange, taking $387 million in September, experts have said, bringing the minimum total of cryptocurrency North Korea has stolen to roughly $13.5 billion, according to Michael Barnhart, a researcher with cybersecurity firm DTEX.
Sophisticated Methods
Binance said it and others were working to freeze some of the stolen cryptocurrency, with about $3 billion located so far. "After Bitget, a lot of the community expected something like this," Barnhart said.
TraderTraitor is North Korea's most capable hacking group with a primary focus on financials and one staffed by some of the most experienced operators in the regime's cyber programs in the former APT38 ranks, he added, referring to North Korea's long-running financially focused hacking units.
This group in particular are somewhat artists in terms of getting into these distributed finance companies.
Researchers say TraderTraitor targets developers and IT staff at financial institutions through malware or phony job offers, tricking candidates into downloading malicious software during fake job interviews, giving the hackers access to login credentials and other sensitive data.
National Security Threat
After stealing the money, the hackers pass it to Chinese organised crime money-laundering groups, Barnhart said. North Koreans also secretly take jobs at tech and financial companies in the US and other countries to earn money to send back to the North Korean government and steal sensitive data.
A US State Department spokesman said North Korean cybercrime is a "global problem" and that the country has increasingly turned to cybercrime to circumvent international sanctions and fund its unlawful weapons of mass destruction and ballistic missile programs. Cryptocurrency heists and laundering have become a significant part of this strategy.
North Korean leader Kim Jong Un has called for the country to seize "absolute superiority" in drone and other military technology, and the drone program's gains are directly tied to the heists and the overseas IT worker schemes, Barnhart said. The country is also aiding Russia's war effort, he added.
Related
