U.S. authorities attributed to TraderTraitor the theft of more than USD 6 billion in virtual assets from Binance, committed on October 29. The group, linked to the North Korean regime, was identified as responsible for the largest cryptocurrency theft in history.
The FBI's accusation once again placed the North Korean hacking structure at the center of international alerts. The funds obtained through these attacks, according to researchers and international organizations cited by AFP, could fuel military research and Pyongyang's weapons program.
TraderTraitor is a hacking operation related to Lazarus Group, a North Korean network that gained notoriety after the attack on Sony Pictures. That episode occurred as retaliation for The Interview, a satirical film that mocked the North Korean leader Kim Jong-un. Its members seek to enter corporate systems, seize digital assets, and move them outside traditional financial circuits.
North Korea has invested in cyber capabilities since at least the mid-1990s. South Korean intelligence estimated in 2024 that this force had about 8,400 members.
"North Korea has created a very capable cyber force," the FBI stated on its website. The Federal Bureau of Investigation maintained that the regime channels some of its best students into training in compu
AI Brief
Your highlights
North Korea's TraderTraitor hackers were charged over the multimillion-dollar cyberattack on Binance (REUTERS/Dado Ruvic)
U.S. authorities attributed to TraderTraitor the theft of more than USD 6 billion in virtual assets from Binance, committed on October 29. The group, linked to the North Korean regime, was identified as responsible for the largest cryptocurrency theft in history. The FBI's indictment once again placed the North Korean hacking structure at the center of international alerts. The funds obtained through these attacks, according to researchers and international organizations cited by AFP, could fuel military research and Pyongyang's weapons program.
TraderTraitor is a hacking operation related to Lazarus Group, a North Korean network that gained notoriety after the attack on Sony Pictures. That episode occurred as retaliation for The Interview, a satirical film that mocked North Korean leader Kim Jong-un. Its members seek to gain access to corporate systems, seize digital assets, and move them outside traditional financial circuits.
North Korea has invested in cyber capabilities since at least the mid-1990s. South Korean intelligence estimated in 2024 that this force had about 8,400 members.
"North Korea has created a highly capable cyber force," the FBI stated on its website. The Federal Bureau of Investigation maintained that the regime channels some of its best students into training in computer science and information technology.
FBI seal (AP/Jenny Kane)
Much of these operations would be under the direction of the Reconnaissance General Bureau, Pyongyang's main foreign intelligence agency. Park Choong-kwon, a South Korean lawmaker and North Korean defector, told AFP that the recruitment of specialists began in educational settings. "The two best students in my class were recruited for the hacking unit," he said. Park had studied at North Korea's National Defense University before leaving the country.
The operators pose as recruiters offering attractive jobs. The goal is to convince their victims to download files containing malicious programs. Once installed, these programs allow attackers to enter computer systems, obtain confidential information, and steal digital assets.
A case in 2024 showed the method used by the network. The theft affected DMM Bitcoin, a Japanese cryptocurrency exchange platform, and amounted to USD 308 million. A North Korean hacker contacted an employee of an independent company that developed programs for cryptocurrency wallets via LinkedIn. The attacker posed as a recruiter and sent him what appeared to be a job pre-screening test. The document actually included a line of malicious code. According to the FBI, this maneuver allowed the hacker to access the system and impersonate the worker.
The activity attributed to hackers spans cyberattacks against traditional financial institutions and virtual asset companies. In 2016, the attackers stole USD 81 million from the central bank of Bangladesh. A year later, the WannaCry ransomware attack disrupted the operation of computers in various countries.
Images of the cryptocurrency Binance Coin (REUTERS/Dado Ruvic)
U.S. authorities attributed in 2022 to hackers related to Lazarus the theft of nearly USD 620 million from the Ronin blockchain network. The FBI again pointed to TraderTraitor for three other thefts that occurred in 2023: Atomic Wallet, Alphapo, and CoinsPaid lost nearly USD 200 million combined, according to the agency. The figure grew markedly in February 2025, when the U.S. agency held the group responsible for the theft of about USD 1.5 billion in virtual assets from Bybit. "TraderTraitor agents are acting quickly," the FBI said at the time. The agency added that the attackers had already converted part of the stolen assets.
The stolen funds would not remain frozen in cryptocurrencies. Lim Eul-chul, a professor at the Institute for Far Eastern Studies at Kyungnam University, explained that the regime converts them into cash through mixing services or private exchanges.
"The funds obtained are channeled directly into military research," Lim said. The academic included among the destinations the illicit acquisition of weapons components and the defense industry.
A United Nations report published in 2024 indicated that the income generated by North Korean cyberattacks allegedly contributed to the development of weapons of mass destruction. The model allows Pyongyang to circumvent the limits imposed by international sanctions on its trade and access to foreign currency.
North Korean dictator Kim Jong-un (REUTERS)
Lim told the agency that digital theft offers multimillion-dollar gains with few human and material resources. "Cyber theft allows him to acquire billions of dollars," he noted. The professor added that cryptocurrencies facilitate this mechanism because they operate outside conventional banking channels and take advantage of the pseudonymous and cross-border nature of digital assets.
(With information from AFP)