North Korean hackers spent days preparing what is described as probably the largest cyberattack against a cryptocurrency exchange. Once the operation began, however, they reportedly needed only 20 minutes to withdraw digital assets worth $6.36 billion—an amount equivalent to roughly 20 percent of North Korea’s economic output.
The targets were accounts at Binance, the world’s largest cryptocurrency exchange, headquartered in Abu Dhabi. The attack has been attributed to “Trader Traitor,” an elite group organized by the North Korean regime for high-impact operations. According to the FBI, the group is at the forefront of a wider network of about 6,000 North Korean cybercriminals linked to the country’s security apparatus.
The precise method of the latest attack remains unclear. Binance is investigating whether an employee’s laptop was compromised and then used to authorize cryptocurrency transfers. The FBI said it followed the hackers as they converted much of the stolen money, particularly into Ethereum. South Korean officials reported that the exchange was caught off guard and that emergency measures had little effect, highlighting the capabilities of North Korean operators in cyberspace.
Pyongyang’s cyber operations are not limited to financial theft. North Korea also targets the leadership networks of foreign militaries. South Korea’s military recorded 19,000 cyberattacks originating from North Korea last year alone, according to the report.
Under Kim Jong-un, cyber groups have become a central part of North Korea’s defense, espionage and foreign-currency strategy. Analysis firm Chainalysis reported that North Korea accounted for 89 percent of cryptocurrency stolen worldwide through hacks this year. A study published in October by the German Institute for International and Security Affairs described the country’s cyber activity as a long-term national project whose professionalism is comparable to the cyber programs of China and Russia.
The report said North Korean hackers were responsible for financial theft on a scale not associated with any other country. It also linked the expansion of the program to international support, particularly from China and Russia.
North Korea intensified its cyber operations after international sanctions were tightened about a decade ago. Between 2022 and 2024, North Korean hackers reportedly stole $4 billion in cryptocurrency. Last year, Trader Traitor took $1.5 billion in a single attack on the exchange Bybit.
The stolen funds are believed to support North Korea’s nuclear and missile programs. The specialist publication 38 North described the digital assets as a shadow fund that can evade conventional sanctions. It characterized the system as a state-directed digital kleptocracy operating much like a sovereign fund, financed by stolen cryptocurrency and protected from traditional financial controls. Artificial intelligence and North Korean IT workers deployed around the world are helping to expand the operation, according to the report.
The United States, Japan and South Korea formed a partnership in 2025 to counter North Korean cyberattacks, with plans to involve private companies. In a joint statement, the three countries said Pyongyang’s cyber program threatened their countries and the wider international community, particularly the integrity and stability of the international financial system. Their cooperation was intended both to prevent future thefts and to recover assets that had already been stolen.
An earlier case illustrated the methods used by North Korean operators. Japanese police and the FBI said a hacker had posed as a recruiter on LinkedIn and contacted an employee of a company. The employee was sent what appeared to be a recruitment test, which gave the attackers access to the company’s systems. They then impersonated the employee in a request to Japan’s DMM cryptocurrency exchange, resulting in the loss of 4,502.9 bitcoin, valued at $308 million at the time.
Cryptocurrency theft has become one of North Korea’s most important sources of revenue. Chainalysis estimated that North Korean groups obtained about $2 billion through attacks on exchanges and cyber extortion during all of 2025—less than one-third of the amount reportedly taken in the latest heist. South Korea’s central bank estimates North Korea’s gross national income at the equivalent of €32.3 billion.
North Korea has also generated income through other activities. Bloomberg Economics calculated that the country may have received $22 billion from Russia since the beginning of the war in Ukraine in 2022, in exchange for Weapons, ammunition and missiles as well as soldiers sent to the Russian front. A multinational sanctions-monitoring team estimated that North Korea earns up to $800 million from sending forced laborers abroad. The team said as many as 100,000 North Korean workers are currently employed in factories, construction and other sectors, with their wages largely confiscated by the regime.
Sources: FAZ.