Cryptocurrency heists have become a lifeline for cash-str... - The Observer

The main part of the attack against Binance took just 20 minutes. The platform initially said it involved a laptop compromised by malicious software, but co-CEO Richard Teng later said "additional points of breach" were discovered. About $3bn of the $6.3bn was frozen before the hackers could make off with it.

Although Binance is covering any customer losses, users withdrew $4.7bn after the cryptocurrency exchange resumed trading on Sunday. The FBI has attributed the breach to a notorious hacking unit called TraderTraitor, part of a North Korean cyber warfare organisation called the Lazarus Group.

Growing threat

North Korea's cryptocurrency heists have grown in scale and now account for most of the cryptocurrency stolen each year. These attacks are funding the country's nuclear weapons programme, according to UN reports. Pyongyang was responsible for 80% of the cryptocurrency lost to hacks in 2025, up from 15% in 2021.

These activities generated about half of Pyongyang's foreign currency earnings.

Sanctions evasion

Shut out of the global economic system by sanctions, North Korea has long relied on illicit activities to boost its economy. It has traded in counterfeit cigarettes, methamphetamine and arms. The regime also employs an army of scammers who use fake identities to secure remote work at Western companies.

Cryptocurrency hacks have proved far more lucrative. In 2024 a UN report identified 58 suspected crypto heists linked to North Korea between 2017 and 2023 worth about $3bn. Since then the sums have grown far larger, with TraderTraitor linked to the theft of $308m from Japanese crypto company DMM in December 2024 and $1.5bn from Bybit in February 2025.

Elite operation

North Korea's hacking operation is shrouded in secrecy. South Korean intelligence estimates that 8,400 people are involved in its cyber warfare operations, although TraderTraitor may only comprise a dozen or so elite hackers. The programme recruits promising maths, engineering and science students as teenagers for specialist training programmes lasting three to five years.

Crypto exchanges offer tempting targets due to the amount of assets they hold, their relatively lax security controls and the anonymity digital assets afford. The $6.3bn stolen from Binance represents about a fifth of North Korea's estimated economic output and far outstrips the $4.5bn it received in arms sales from Russia.