Cyber experts say $6.3 billion theft was state-run program; 'up to their old tricks'
By Dasl Yoon and Patricia Kowsmann
SEOUL -- Just hours after crypto exchange Binance said it had been the victim of the biggest cyber heist in history, fingers were pointing to a familiar name: North Korea.
Cybersecurity researchers and investigators said blockchain activity indicates that an elite North Korean hacking unit, known as TraderTraitor, pulled off the $6.3 billion hack of the world's biggest crypto exchange. The spectacular heist illustrates the ability of North Korean cybercriminals to bypass surveillance systems and land enormous hauls that underwrite Pyongyang's growing nuclear program.
"This is state-sponsored theft at a scale that no criminal group comes close to, with the proceeds funding North Korea's weapons programmes," said Tom Robinson, founder of analytics firm Elliptic, which has found the attack consistent with TraderTraitor's methods.
On Thursday evening, hackers moved the $6.3 billion out of Binance wallets within about 20 minutes, according to analytics firm TRM Labs. In February 2025, the group stole $1.5 billion from crypto exchange Bybit in what was then the record for a cyber heist. Last month, it stole $387 million from another crypto exchange, Bitget, according to analytics firm Chainalysis.
Stablecoin providers and others quickly froze about $2.8 billion of Binance's stolen assets, but over $3 billion is likely out of reach because it can't be frozen, according to the analytics firms.
TraderTraitor is a code name used by the Federal Bureau of Investigation referring to a state-sponsored cybercrime unit that originated between 2016 and 2017 under Pyongyang's spy agency tasked with stealing cryptocurrency, according to the Multilateral Sanctions Monitoring Team, a group of 11 nations including the U.S. that documents North Korea's sanctions violations.
The sophisticated unit uses social-engineering techniques and advanced technical tradecraft to conduct large-scale heists, MSMT said in a report last year. Between January 2024 and September 2025, the group had stolen some $2.6 billion in crypto, making it one of the biggest profit machines for the regime. The Binance hack now pushes the figure to over $5 billion.
North Korean cybercriminals "are up to their old tricks," Chainalysis co-founder Jonathan Levin said in a post on X.
TraderTraitor operators pose as recruiters or potential business partners to build trust with company employees, tricking them into downloading malicious software and handing the hackers full control, according to a joint advisory issued by U.S. government agencies in 2022. This allows the hackers to roam through the company's internal network and initiate cryptocurrency transfers.
In a 2024 hack of a Japanese crypto exchange called DMM Bitcoin, a TraderTraitor figure posed as a recruiter on LinkedIn to pass malicious files to an employee of a third-party vendor responsible for storing crypto for DMM, MSMT said, citing information from its country members. Once inside the vendor's system, the hackers were able to manipulate transaction requests from DMM and obtain over $300 million worth of cryptocurrencies.
Binance has said that the breach may have involved "a compromised DevOps engineer's laptop" that allowed the attacker to "submit unauthorized withdrawal transactions." Binance added that there were also "additional points of breach."
But what makes TraderTraitor and other North Korean crypto hackers exceptionally effective is what they do once they have stolen the crypto. After breaching a large Indian crypto exchange in 2024, hackers used algorithms to spread funds through global crypto networks, doing it faster than any human could and making them virtually impossible to recover.
"The hackers may not be leading-edge security experts in the conventional sense, but very efficient at exploiting vulnerabilities," said Jonathan Reiter, co-founder of ChainArgos, a blockchain analytics platform.
Cryptocurrency heists have become North Korea's most lucrative and vital revenue stream, replacing exports of coal and textiles that have been crippled by global sanctions.
But pulling off billion-dollar heists is only half the task. It can take months, if not years, to convert stolen crypto into hard currency. Funds must be dispersed across different blockchains to erase digital trails before moving through networks of illicit brokers who cash them out for the regime of Kim Jong Un.
The Binance breach highlights an increasingly lopsided game between Washington and Pyongyang. While the U.S. and its allies deploy tracing software and slap sanctions on groups and individuals to crack down on cybercrime, North Korean hackers easily deploy phishing emails or trick unwitting developers to steal millions within minutes.
Cybercrime funds roughly half of North Korea's missile program, U.S. officials have said. In recent years, North Korea has tested intercontinental ballistic missiles capable of reaching the U.S. mainland, new hypersonic systems and more accurate short-range ballistic missiles.
Kim has laid out ambitions to accelerate missile production and amass more nuclear warheads. A cash injection from the Thursday heist could supercharge Kim's drive to develop advanced drones, warships and a nuclear-powered submarine.
In March, North Korea denied allegations that it was behind global cyber heists. In a statement, North Korea's Foreign Ministry said the U.S. was spreading "absurd slander" to tarnish its image.