In just 20 minutes, the thieves made off with most of a haul of 6.3 billion dollars. The heist was record-breaking, and the escape, with a click, left a labyrinth of transfers difficult to trace.
The assailants infiltrated the systems of Binance, the world's largest cryptocurrency platform, on 29 October and emptied its digital wallets. According to the FBI, behind the largest theft in cryptocurrency history is one of Kim Jong-un's most lucrative tools: TraderTraitor, an elite unit of North Korean hackers.
One of the most disconnected countries on the planet has managed to build one of the world's most lucrative digital theft industries. And its profits help finance Kim Jong-un's missiles and nuclear bombs.
The American cybersecurity firm TRM Labs reconstructed how the hackers began preparing this latest operation at least 36 hours in advance and transferred billions through ten blockchain networks, via a dizzying succession of automated transfers. Binance suspects they compromised the laptop of one of its engineers and exploited other security breaches. According to its co-CEO, Richard Teng, they even employed a self-destruct mechanism to erase the digital fingerprints of the assault.
Following the heist, a multi-million dollar chase began through the cryptocurrency universe. Binance announced on Saturday that it had replenished 90% of the stolen assets with its own funds. And the FBI confirmed on Saturday the responsibility of TraderTraitor and warned that the attackers were converting a large portion of the stolen money into ethereum, one of the main cryptocurrencies.
Investigators anticipate that these assets will subsequently be laundered through decentralised financial services. The agency published a list of digital wallet addresses linked to the theft and urged companies in the sector to block any transactions related to them.
For US agents, the name TraderTraitor is not new. The FBI had already held this unit responsible for the attack on Bybit in February 2025, when North Korean hackers stole around 1.5 billion dollars. The group is linked to the Lazarus constellation, associated with Pyongyang's intelligence services. Its history began long before the emergence of bitcoin.
8,400 hackers at the service of Pyongyang
Since the 1990s, North Korea has focused on training specialists in cyber warfare. In a country where the vast majority of the population cannot freely access the internet, the brightest students in mathematics and computer science are selected to wage a clandestine battle from the keyboard. South Korean intelligence estimated in 2024 that the regime had around 8,400 hackers dedicated to cyber operations, some deployed abroad, mainly in China.
Lazarus rose to fame in 2014 with the hacking of Sony Pictures, related to the release of The Interview, a comedy that ridiculed Kim Jong-un. Subsequently, espionage and sabotage gave way to increasingly ambitious thefts. In 2016, the hackers attempted to steal nearly 1 billion dollars from the Central Bank of Bangladesh, although they ultimately managed to obtain 81 million.
With cryptocurrencies, they found a gold mine. In 2022, Washington attributed to Lazarus the theft of around 620 million dollars from the Ronin network, linked to a video game. In 2024, the Japanese platform DMM Bitcoin lost another 308 million in an operation attributed to TraderTraitor. And in February 2025 came the blow to Bybit, so far the largest digital heist in history. Chainalysis, a US firm specialising in tracking cryptocurrency transactions, estimates that North Korean groups stole 2.02 billion during 2025. The assault on Binance has quadrupled the previous record in a single operation.
International sanctions have closed off much of North Korea's banking and commercial circuits, but the regime continues to expand its nuclear arsenal and develop new ballistic missiles. A UN expert panel investigated 58 possible cyberattacks against cryptocurrency companies between 2017 and 2023, valued at around 3 billion dollars. Its report noted that these activities provided around half of the regime's foreign currency and financed up to 40% of its weapons of mass destruction programme.
From Seoul, Lim Eul-chul, a professor at the Institute of Far Eastern Studies at Kyungnam University, explains that cyberattacks have become a fundamental tool for circumventing international economic sanctions. The academic, in statements reported by AFP, asserts that the income obtained from these thefts is allocated to military research. Unlike conventional trade, which is subject to strict controls, cryptocurrencies allow vast amounts of money to be moved across borders without resorting to traditional banking.
Adam Farrar, a geoeconomics analyst for Asia-Pacific at Bloomberg Economics, warns that even if half of the money stolen from Binance is recovered, Pyongyang could still have billions more to develop ballistic missiles and expand its nuclear arsenal. "North Korea has every incentive to continue exploiting the gaps in the cryptocurrency ecosystem to finance its military ambitions. The attack on Binance will not be the last", the expert points out.
The methods of North Korean hackers combine rudimentary deception with cutting-edge technology. A fake recruiter contacts a programmer, offers them a promising job, and sends them a technical test that conceals malicious software. This is how the FBI described the attack on DMM Bitcoin. Once inside the systems, the intruders search for credentials and permissions that allow them to order transfers. At Binance, Chainalysis detected movements so numerous and rapid that it ruled out human intervention in each operation. "It had to be a computer doing it," explained its researcher Eric Jardine to Axios.
South Korean intelligence services warn of a threat that transcends mere money theft. According to an investigation published by the South Korean newspaper The Korea Herald, South Korean authorities recently detected around 4.4 million attempts to probe vulnerabilities against financial entities in the country originating from internet addresses assigned to North Korea.
Michael O'Loughlin, an executive at Argonautic Global, warns that these groups have enormous resources and objectives that go far beyond economic gain. "You don't need to defeat an entire financial system to steal from it. Sometimes it's enough to compromise a person with the right permissions", he explains.
Why is it so difficult to stop them?
Ciaran Martin, former head of the UK's National Cyber Security Centre, argues that traditional banks have developed much more sophisticated defences than those in the cryptocurrency industry.
Chainalysis has also documented the involvement of international networks of intermediaries that facilitate the laundering of illicit funds, especially through services operating in Chinese. Police cooperation stumbles over borders, opaque jurisdictions, and a regime that systematically denies its involvement in these crimes.
While investigators chase a bounty that constantly changes digital direction, Pyongyang has found a lucrative avenue to fuel its nuclear machinery.