[Editorial] Hack attributed to North Korea threatens national security beyond crypto assets

Cyberattacks originating from North Korea are shaking national security, extending beyond the crypto asset market. About $6.3 billion (₩8.4 trillion) worth of crypto assets was stolen from Binance, the world’s largest crypto exchange, and on the 1st the U.S. Federal Bureau of Investigation (FBI) identified North Korea as being behind the attack. Since funds obtained through crypto hacks flow into nuclear and missile development, exchange security and international cooperation must be comprehensively reassessed as national security issues.
This attack shows just how sophisticated North Korea’s hacking operations have become, both in scale and method. The FBI said an elite North Korean hacking group called TraderTraitor hacked a Binance engineer’s laptop to obtain signing authority, then siphoned assets from 10 blockchain wallets. The attackers were so meticulous and swift that, after even conducting a test 36 hours in advance, they took just 20 minutes to steal the core assets. It is an extremely serious problem that it was employees’ devices and access controls—not core servers—that were breached.
Crypto asset theft linked to North Korea is not a one-off incident affecting just one country. It requires an international response. Blockchain analytics firm TRM Labs estimated that about 66% of global losses from crypto hacks in the first half of this year stemmed from attacks linked to North Korea. Chainalysis estimated that North Korea-linked hacking groups stole $2.02 billion (₩2.6 trillion) last year, up 51% from the previous year, and said their cumulative thefts had reached $6.75 billion (₩9 trillion). The U.S. Director of National Intelligence (DNI) assessed that North Korea secures at least $1 billion (₩1.3 trillion) a year through financial crimes and uses it to develop weapons.
Given that illicit funds are used to develop nuclear weapons and missiles, the damage cannot be treated as a matter solely for exchanges and their users. In 2024, an expert panel of the UN Security Council Committee established pursuant to resolution 1718 (2006) said, “North Korea covers 40% of the funding for developing weapons of mass destruction, including nuclear weapons, with money obtained illegally and clandestinely.” Allowing North Korea to continue stealing crypto assets could undermine the global sanctions regime and result in tacitly facilitating weapons development.
The domestic market has long ceased to be a safe haven. The National Office of Investigation of the Korean National Police Agency concluded that a 2019 theft of Ethereum worth about ₩58 billion at the time from Upbit was the work of a hacking group under North Korea’s Reconnaissance General Bureau. Security incidents occurred at Upbit last year and at GOPAX and Bithumb this year, and on the 28th of last month, Bithumb suffered a personal data breach. North Korean hackers’ involvement cannot be ruled out, and the leaked personal data could lead to further harm, so this is by no means an issue to be taken lightly.
Some argue that individual exchanges cannot prevent every attack backed by a state, and that increasing compensation reserves could slow market growth. But the sophistication of an attack does not lessen the responsibility of businesses entrusted with customers’ assets. Growth achieved by cutting security costs can collapse, along with trust, after a single incident. Segregating core wallets, requiring multiple approvals, minimizing account privileges for employees, securing devices, and blocking suspicious transactions are not optional—they are basic obligations.
The government should move beyond perfunctory inspections focused on paperwork and procedures and verify exchange security on the assumption of real-world attacks. Businesses should transparently disclose their procedures for suspending withdrawals and notifying customers, and establish comprehensive standards for insurance and reserves. In particular, the government and exchanges should share information about North Korean attacks in real time and strengthen cooperation with major countries to block money laundering. Both the government and businesses must remember that the crypto asset market can grow only when security is in place, and the national economy can grow only when underpinned by national security.