When the world’s largest cryptocurrency heist takes place, it doesn’t take long for the finger to be pointed at one particular country.
North Korea is known as the hermit kingdom. It is ruled by a regime that isolates its people from the internet out of fear of outside information infiltrating its borders. But when it comes to cyberwarfare, not least cryptocurrency thefts, Pyongyang is anything but a hermit. With hackers stealing $6.3 billion overnight from the digital wallets of Binance, the world’s largest cryptocurrency exchange, it is no surprise that North Korea is the likely perpetrator. After all, the Kim regime will do everything and anything to get money, both for itself and its ever-expanding nuclear weapons program.
The $6.3 billion stolen from Binance amounts to nearly a quarter of the total size of North Korea’s economy
Even though North Korea is yet to claim responsibility for the Binance hack, the theft is hardly out of line with Pyongyang’s past behavior. Last year, North Korea amassed a record $2 billion through cryptocurrency raids. Not only was this a 50 percent increase from the previous year, but more concerningly, the number of attacks were fewer. One such attack came in February 2025, after which the Dubai-based cryptocurrency exchange, Bybit, would find itself short of $1.5 billion.
All these acts are committed by hackers forming the ominously-named Lazarus Group, which is organized, overseen, and led by the North Korean state (ironically, St. Lazarus is the patron saint of the poor). Operating under the Reconnaissance General Bureau, North Korea’s intelligence agency responsible for clandestine operations, the Lazarus Group has unknown membership and uses multiple aliases when committing its thefts. The suspects behind this week’s hack go by the name TraderTraitor. In May 2024, TraderTraitor stole over $300 million from Japanese cryptocurrency exchange, DMM Bitcoin, by duping an employee of the firm’s cryptocurrency wallet system provider into downloading a Python script.
Under another alias, namely, “Guardians of Peace,” the Lazarus group infamously hacked into Sony Pictures in 2014, a month before the film, The Interview – which sees two journalists meet and eventually kill North Korean leader Kim Jong-un – was due to be released across US cinemas.
The $6.3 billion stolen from Binance amounts to nearly a quarter of the total size of North Korea’s economy. Weapons of mass destruction do not come cheap, however, not least a nuclear program that is continually expanding in both quality and quantity. With $6.3 billion, North Korea could buy at least two short-range Scud ballistic missiles.
Illicit cyber acts and digital theft fund 40 to 50 percent of North Korea’s nuclear and missile programs and generate about half of North Korea’s foreign currency income. For a country still hit by sanctions – despite China and Russia’s ongoing help evading them – cryptocurrency thefts are a convenient way to replenish the Kim regime’s coffers.
In the early 2000s, North Korea earned foreign currency by operating state-run restaurants overseas, including in China, Russia and Southeast Asia. Many, but not all, closed as sanctions and coronavirus struck. Fortunately for the Kim regime, the world of cryptocurrency and cyberwarfare is far more lucrative.
North Korea’s activities do not stop at cryptocurrency heists. It has gained notoriety for hacking into the computer systems of western commentors by impersonating South Korean academics (a scam which was once used against the author of this article). What’s more, Pyongyang has a vast global network of nearly 10,000 IT workers, a scheme which gained traction under the rule of the current leader, Kim Jong-un. Whether in China, Russia, or further afield, these workers have learned how to master the art of employment fraud. After stealing identities of existing workers in western companies, these operatives create fake profiles, apply for remote jobs in western firms, gain access to a company’s systems – with the help of western-based facilitators – and pocket the cash, sending nearly 90 percent of their earnings back to the Kim regime. It is no surprise that North Korea’s annual revenue from these IT workers alone can reach over $500 million.
But is the Binance hack just the work of Pyongyang? Even though North Korea is the highly likely culprit for Binance’s latest troubles, we must not forget about North Korea’s new alliance with Russia. It is not just munitions, missiles and manpower heading in the Kremlin’s direction. When Russia and North Korea signed a mutual defense treaty in June 2024, the two countries pledged to strengthen ties in and beyond the realm of security: one of the other areas was information technology. Cooperation between Moscow and Pyongyang in cyberwarfare should therefore not be ruled out.
We must now wait and see as to whether the Lazarus Group, in all its guises, comes forward either to protest its innocence or accept responsibility for the Binance theft. The most likely option is silence.
Stealing $6.3 billion from the world’s largest cryptocurrency exchange is no mean feat. It is a reminder to the West that we must take North Korea seriously. For as long as the country continues to develop its nuclear weapons, it will need to find money to pay for them.
Comments