North Korea loots Binance, earning infamy as the world’s biggest cryptocurrency thief

【Financial News, New York = Correspondent Lee Byung-chul】  A record-breaking hacking incident has struck the world’s largest cryptocurrency exchange, Binance, with $6.3 billion (about 9 trillion won) stolen. North Korea’s elite hacking group has been identified as being behind the attack. The hackers are believed to have siphoned off vast amounts of cryptocurrency in just 20 minutes. Analysts say North Korea is using cybercrime as a key source of foreign currency, selecting gifted math and science students from their teens and training them to become professional hackers.
On the 30th, local time, the Wall Street Journal (WSJ) and the Financial Times (FT) reported that cybersecurity experts believe it is highly likely North Korea’s elite hacking group TraderTraitor was behind the Binance hack. Blockchain analytics firm TRM Labs said the hackers moved $6.3 billion from Binance wallets to external addresses in about 20 minutes on the evening of the 29th.
Binance completely halted deposits and withdrawals. Initial investigations raised the possibility that unauthorized withdrawal transactions were carried out after a DevOps engineer’s laptop was hacked. About $2.8 billion in stolen assets has been frozen, but at least $3 billion is expected to be difficult to recover.
TraderTraitor is a codename used by the U.S. Federal Bureau of Investigation (FBI) for a North Korean hacking group. Its members pose as recruiters or business partners to approach company employees and then trick them into installing malware. Once inside a company’s systems, they steal cryptocurrency and use algorithms to disperse the funds across multiple blockchains to evade tracking.
North Korea’s hacking capabilities are believed to stem from systematic, state-level training of personnel. According to South Korea’s National Intelligence Service, North Korea has an estimated 8,400 people involved in cyberwarfare, including technical support staff. North Korea selects students with strong math and science skills from their teens and trains them in hacking, codebreaking and other fields for three to five years. Some elite operatives are reportedly given further training in China and Russia.
With international sanctions blocking coal and textile exports, cryptocurrency theft has become one of North Korea’s main sources of funding. According to blockchain analytics firm Chainalysis, North Korean hackers stole about $2 billion last year. That amounts to about 60% of all cryptocurrency stolen worldwide. The losses from the Binance hack are equivalent to about one-fifth of North Korea’s gross national income (GNI).
North Korea was also named as being behind the theft of $1.5 billion from Bybit in February 2025. U.S. officials believe that about half of the funding for North Korea’s missile development comes from cybercrime.
North Korea has denied allegations of involvement in international cybercrime and has retorted that the United States is spreading “outrageous slander.”



[email protected] Correspondent Lee Byung-chul Reporter