North Korean hackers linked to crypto thefts among world’s best, experts say

NEW YORK - North Korean hackers likely behind the record US$6.3 billion (S$8 billion) theft from cryptocurrency exchange Binance are among the world’s most prolific crypto thieves, and the proceeds help fund the country’s weapons programmes, cybersecurity experts said on Oct 30.

Blockchain investigation firms TRM Labs and Chainalysis attribute the heist to a North Korean hacking group known as “TraderTraitor,” a name used in a 2022 joint warning from the FBI, CISA and US Treasury that described how hackers used malicious software and other tricks to target software developers and IT staff at cryptocurrency companies.

North Korea stole at least US$6.75 billion in cryptocurrency through the end of 2025, Chainalysis said in a December 2025 report. That total includes the US$1.5 billion ByBit exchange hack in February 2025.

The group also hit Bitget, a separate exchange, taking US$387 million in September, experts have said, bringing the minimum total of cryptocurrency North Korea has stolen to roughly US$13.5 billion, said Michael Barnhart, a researcher with cybersecurity firm DTEX.

Binance said it and others were working to freeze some of the stolen cryptocurrency, with about US$3 billion located so far.

“After Bitget, a lot of the community expected something like this,” Barnhart said.

TraderTraitor is North Korea’s “most capable hacking group with a primary focus on financials and one staffed by some of the most experienced operators in the regime’s cyber programs in the former APT38 ranks,” he added, referring to North Korea’s long-running financially focused hacking units.

Researchers say TraderTraitor targets developers and IT staff at financial institutions through malware or phony job offers, tricking candidates into downloading malicious software during fake job interviews, giving the hackers access to login credentials and other sensitive data.

Rafe Pilling, a senior director of threat research at Sophos, said early reports of how the hackers compromised Binance match the North Korean playbook, and that the group is expert at working out how a company’s systems and staff approve money transfers. “This group in particular are somewhat artists in terms of getting into these distributed finance companies,” he said.

From crypto theft to weapons funding

After stealing the money, the hackers pass it to Chinese organised crime money-laundering groups, Barnhart said.

North Koreans also secretly take jobs at tech and financial companies in the US and other countries to earn money to send back to the North Korean government and steal sensitive data, the FBI said in an Oct 13 public service announcement, adding that money raised by the workers and hackers helps fund North Korean nuclear and military programmes.

A US State Department spokesman said North Korean cybercrime is a “global problem” and that the country has “increasingly turned to cybercrime to circumvent international sanctions and fund its unlawful weapons of mass destruction and ballistic missile programmes. Cryptocurrency heists and laundering have become a significant part of this strategy.”

North Korean leader Kim Jong Un has called for the country to seize “absolute superiority” in drone and other military technology, and the drone programme’s gains are directly tied to the heists and the overseas IT worker schemes, Barnhart said.

The country is also aiding Russia’s war effort, he added.

“North Korea has sent troops, munitions, and weapons components to Russia, all funded through the same system, which is why a crypto hack is a national security issue and not only a problem for the exchange that got hit,” Barnhart said. REUTERS