$6.3bn Cyberhack:Experts Link North Korea To Binance Crypto Heist

North Korea’s growing involvement in cryptocurrency theft has come under renewed scrutiny following the $6.3 billion cyberattack on global cryptocurrency exchange Binance, with cybersecurity experts warning that proceeds from the operations are helping to finance the country’s nuclear and military programmes.

Investigations by blockchain intelligence firms, TRM Labs and Chainalysis, have linked the record-breaking theft to TraderTraitor, a North Korean hacking group regarded as one of the country’s most sophisticated cybercrime units.

The group is believed to have developed extensive capabilities in targeting cryptocurrency platforms, financial institutions and technology companies, using malicious software, stolen credentials and sophisticated social engineering techniques to gain access to sensitive systems.

According to cybersecurity experts, North Korea had stolen at least $6.75 billion in cryptocurrency by the end of 2025, based on a December report by Chainalysis. The figure included the $1.5 billion cryptocurrency theft from exchange Bybit in February 2025.

However, subsequent attacks have pushed the estimated value of cryptocurrency stolen by North Korean-linked hackers to approximately $13.5 billion, according to Michael Barnhart, a researcher at cybersecurity firm DTEX.

The group was also linked to a September attack on cryptocurrency exchange Bitget, in which approximately $387 million was stolen.

Barnhart said the latest Binance incident was not entirely unexpected, given the pattern of attacks targeting major cryptocurrency platforms.

“After Bitget, a lot of the community expected something like this,” he said.

He described TraderTraitor as North Korea’s most capable hacking group focused on financial operations, adding that it comprises some of the most experienced operatives drawn from the country’s cyber programmes, including former members of APT38, a long-running financially motivated hacking unit.

Meanwhile, researchers said the hackers frequently target software developers and information technology personnel working for financial institutions through fake recruitment exercises and job interviews.

Under the approach, unsuspecting candidates are persuaded to download malicious software during what appears to be a legitimate employment assessment, giving attackers access to login credentials and other confidential information.

Senior director of threat research at Sophos, Rafe Pilling said preliminary accounts of the Binance breach reflected methods previously associated with North Korean cyber operations.

He noted that the hackers were particularly skilled at understanding how financial technology companies organise their internal systems and authorise transactions.

“This group in particular are somewhat artists in terms of getting into these distributed finance companies,” Pilling said.

Crypto Theft As Weapons Funding

Beyond the immediate financial losses suffered by cryptocurrency platforms, experts have raised concerns about how stolen digital assets are channelled through international criminal networks to support North Korea’s military ambitions.

Barnhart said the hackers typically transfer stolen funds to Chinese organised crime groups involved in money laundering, making it difficult for investigators to trace and recover the assets.

The United States Federal Bureau of Investigation (FBI) also warned on October 13 that North Korean nationals were secretly securing employment with technology and financial companies in the United States and other countries to generate revenue for the government and obtain sensitive information.

According to the FBI, funds generated through these overseas employment arrangements and cyberattacks contribute to North Korea’s nuclear and military programmes.

A US State Department spokesman described North Korean cybercrime as a global security concern, noting that the country had increasingly relied on illicit digital operations to evade international sanctions and finance its weapons development.

The official said cryptocurrency theft and money laundering had become significant components of the country’s strategy to fund weapons of mass destruction and ballistic missile programmes.

Furthermore, Barnhart linked the proceeds from cybercrime to North Korea’s efforts to strengthen its drone and other military technology capabilities, noting that the country’s cyber operations had implications beyond the cryptocurrency market.

He also said North Korea’s military assistance to Russia, including troops, ammunition and weapons components, was connected to the same funding network.

“North Korea has sent troops, munitions, and weapons components to Russia, all funded through the same system, which is why a crypto hack is a national security issue and not only a problem for the exchange that got hit,” Barnhart said.

Meanwhile, Binance said it was working with industry partners to trace and freeze the stolen cryptocurrency, with approximately $3 billion in assets located so far.

The incident has further highlighted the security risks confronting cryptocurrency exchanges as cybercriminal groups increasingly exploit vulnerabilities in digital asset infrastructure.