(Bloomberg) — The North Korean group accused of the largest cryptocurrency theft in history is a state-backed collective of elite hackers, trained from an early age to hunt “big game.” Artificial intelligence has now provided them with a new, powerful tool to fatten Kim Jong Un’s coffers and finance his military expansion.
North Korea, which possesses nuclear weapons, maintains an army of hackers with thousands of members, but the elite unit known as “TraderTraitor,” to which the FBI attributes the recent US$6.3 billion hack of Binance, may have only about a dozen members, according to experts.
Read also:
Unlike ordinary hackers who target individual investors, TraderTraitor uses a strategy known as Big Game Hunting, aided by AI to locate high-value cryptocurrency companies to compromise, cybersecurity experts say. They have been so extraordinarily successful that the revenues they generate may be funding nearly half of North Korea’s prohibited weapons programs.
“This specific group is after a big haul,” said Park Seong-su, Threat Researcher at Zscaler, a cybersecurity company. “They target cryptocurrency-related companies, understand their infrastructure and then tamper with it — or the fund-transfer processes — to execute a large-scale theft.”
With the new AI tools, “the barriers to such capabilities have fallen significantly, while the speed with which these operations can be carried out has increased tremendously,” Park added.
For decades, North Korea has selected its best and brightest students to join its hacker teams, training them at specialized institutions such as Moranbong College in Pyongyang, according to defectors and experts, to create an army that is now believed to be responsible for 89% of losses reported in cryptocurrency hacks this year, according to Chainalysis.
From running laptop farms in the United States to stealing billions in cryptocurrencies in under 30 minutes, their hackers have become one of North Korea’s most important revenue sources, which is isolated from the global financial system due to a series of sanctions over Kim’s nuclear and ballistic missile programs.
Other sources of income for North Korea, such as trade with China and even its military relationship with Russia, are now overshadowed in importance by cryptocurrency money. Previously, Pyongyang smuggled cigarettes and counterfeited U.S. dollars to stay afloat — now its hackers bring in billions in pure profit from a single successful theft.
Read also:
And it may be getting worse, thanks to AI.
Techniques never before seen used by TraderTraitor suggest the group is making extensive use of AI in its recent hacks, said Nick Carlsen, Senior Investigator at TRM Labs. They are certainly breaking revenue records: their previous largest theft was the $1.5 billion Bybit hack in 2025.
Cryptocurrency exchanges are strengthening security, especially for employees with privileged access, to protect themselves against TraderTraitor’s modus operandi: combining high-level hacking skills with social engineering. They are known for identifying employees with high-level access to target systems and aggressively pursuing them with lucrative job offers, Carlsen said.
“Their strength is the human part,” he said.
Read also
Binance says that 95% of affected assets have been replenished; other 5% have low liquidity
According to the company, all affected volumes of Bitcoin, Ether, Tether, BNB, Solana, USD Coin, XRP, USD1, RLUSD and Zcash have been replenished with internal resources and are 100% collateralized
Binance unlocks five more coins for withdrawal and withdrawal volume reaches US$ 5.16 bi
Among the new assets available are the US dollar (USD), United Arab Emirates dirham (AED), Vietnamese dong (VND), Philippine peso (PHP) and Indonesian rupiah (IDR)
Binance said that an initial investigation found a compromised laptop belonging to an engineer as the breach point. In just 20 minutes, the hackers stole US$6.36 billion in cryptocurrencies, an amount equivalent to almost 20% of North Korea’s estimated annual economic output. With about US$2.8 billion frozen after the incident, net outflows total US$3.6 billion.
“For Kim Jong Un’s regime, cryptocurrency hacking has evolved beyond a mere criminal means of offsetting the shortage of foreign currency,” said Lim Eul-chul, professor at the Institute for East Asian Studies at Kyungnam University.
As the United States dedicates substantial resources to conflicts in the Middle East and efforts to contain China and Russia, its ability to actively engage on the Korean Peninsula has diminished, say some observers close to North Korea.
“North Korea is exploiting this period as a golden opportunity to accelerate the development of its military capabilities,” said Lim.
In 2024, UN experts said that North Korea’s cyber thefts and illicit financial activities could be funding about 40% of its weapons of mass destruction programs. And every successful cryptocurrency theft increases Kim’s ability to build his army and threaten South Korea, the United States’ ally, along with the 28,500 American troops stationed on the peninsula.
Nuclear weapons and ballistic missiles have always been the regime’s top priorities and its money, “but now there seems to be enough to support conventional forces, including new warships and investments in drone technology,” said Adam Farrar, former director of the U.S. National Security Council responsible for Korea during the Trump and Biden administrations.
North Korea may still be decades behind South Korea in many military aspects, but perhaps not for much longer, said Farrar, now a senior analyst at Bloomberg Economics.
© 2026 Bloomberg L.P.
