Oct 30 (Reuters) – North Korean hackers, likely responsible for the record US$6.3 billion theft from the cryptocurrency exchange Binance, are among the world’s most prolific cryptocurrency thieves, and the funds obtained help finance the country’s weapons programs, cybersecurity experts said on Friday.
Blockchain investigative firms TRM Labs and Chainalysis attribute the theft to a North Korean hacking group known as “TraderTraitor,” a name used in a 2022 joint alert by the FBI, CISA and the U.S. Treasury that described how the hackers used malicious software and other ploys to attack software developers and IT teams at cryptocurrency companies.
North Korea had stolen at least US$6.75 billion in cryptocurrency by the end of 2025, Chainalysis said in a December 2025 report. That total includes the US$1.5 billion heist at the ByBit exchange in February 2025.
The group also attacked Bitget, a different exchange, taking US$387 million in September, according to experts, raising the minimum total of cryptocurrencies stolen by North Korea to about US$13.5 billion, said Michael Barnhart, a researcher at the cybersecurity firm DTEX.
Binance said that it and other entities were working to freeze part of the stolen cryptocurrencies, with about US$3 billion located so far.
“After Bitget, much of the community already expected something like this,” Barnhart said.
TraderTraitor is the “most capable hacking group in North Korea, with a primary focus on the financial sector and made up of some of the most experienced operators of the regime’s cyber programs, who previously were part of APT38,” he added, referring to North Korea’s long-standing hacking units focused on the financial sector.
Researchers say that TraderTraitor targets developers and IT teams at financial institutions through malware or fake job offers, prompting candidates to download malicious software during fake job interviews, giving the hackers access to login credentials and other sensitive data.
Rafe Pilling, Sophos’s Senior Director of Threat Research, said that early reports on how the hackers compromised Binance align with North Korea’s tactics playbook, and that the group is adept at figuring out how a company’s systems and staff approve money transfers.
“That group, in particular, is almost like a group of artists when it comes to breaching these distributed finance companies,” he said.
Weapon Financing
After stealing the money, the hackers pass it on to Chinese money-laundering groups tied to organized crime, Barnhart said.
North Koreans also secretly take jobs at technology and financial companies in the U.S. and other countries to earn money to be sent back to the North Korean government and to steal confidential data, the FBI said in a public statement on October 13, adding that the money raised by workers and hackers helps finance North Korea’s nuclear and military programs.
A spokesperson for the U.S. State Department said North Korea’s cybercrime is a “global problem” and that the country has “increasingly relied on cybercrime to circumvent international sanctions and finance its illegal weapons of mass destruction and ballistic missile programs.”
“Cryptocurrency theft and money laundering have become a significant part of that strategy,” the spokesperson said.
North Korea’s leader Kim Jong Un urged the country to attain “absolute superiority” in drones and other military technologies, and the gains from the drone program are directly linked to the thefts and to schemes involving IT workers abroad, Barnhart said.
The country is also assisting Russia’s war efforts, he added.
“North Korea has sent troops, munitions and weapon components to Russia, all financed through the same system; that is why a cryptocurrency-related cyberattack is a matter of national security and not just an issue for the exchange that was hacked,” Barnhart said.
