By AJ Vicens
Oct 30 (Reuters) - North Korean hackers likely behind the record $6.3 billion theft from cryptocurrency exchange Binance are among the world's most prolific crypto thieves, and the proceeds help fund the country's weapons programs, cybersecurity experts said on Friday.
Blockchain investigation firms TRM Labs and Chainalysis attribute the heist to a North Korean hacking group known as “TraderTraitor,” a name used in a 2022 joint warning from the FBI, CISA and US Treasury that described
how hackers used malicious software and other tricks to target software developers and IT staff at cryptocurrency companies.
North Korea stole at least $6.75 billion in cryptocurrency through the end of 2025, Chainalysis said in a December 2025 report. That total includes the $1.5 billion ByBit exchange hack in February 2025.
The group also hit Bitget, a separate exchange, taking $387 million in September, experts have said, bringing the minimum total of cryptocurrency North Korea has stolen to roughly $13.5 billion, said Michael Barnhart, a researcher with cybersecurity firm DTEX.
Binance said it and others were working to freeze some of the stolen cryptocurrency, with about $3 billion located so far.
“After Bitget, a lot of the community expected something like this,” Barnhart said.
TraderTraitor is North Korea’s “most capable hacking group with a primary focus on financials and one staffed by some of the most experienced operators in the regime’s cyber programs in the former APT38 ranks,” he added, referring to North Korea’s long-running financially focused hacking units.
Researchers say TraderTraitor targets developers and IT staff at financial institutions through malware or phony job offers, tricking candidates into downloading malicious software during fake job interviews, giving the hackers access to login credentials and other sensitive data.
Rafe Pilling, a senior director of threat research at Sophos, said early reports of how the hackers compromised Binance match the North Korean playbook, and that the group is expert at working out how a company's systems and staff approve money transfers. "This group in particular are somewhat artists in terms of getting into these distributed finance companies," he said.
FROM CRYPTO THEFT TO WEAPONS FUNDING
After stealing the money, the hackers pass it to Chinese organized crime money-laundering groups, Barnhart said.
North Koreans also secretly take jobs at tech and financial companies in the US and other countries to earn money to send back to the North Korean government and steal sensitive data, the FBI said in an October 13 public service announcement, adding that money raised by the workers and hackers helps fund North Korean nuclear and military programs.
A US State Department spokesman said North Korean cybercrime is a “global problem” and that the country has “increasingly turned to cybercrime to circumvent international sanctions and fund its unlawful weapons of mass destruction and ballistic missile programs. Cryptocurrency heists and laundering have become a significant part of this strategy.”
North Korean leader Kim Jong Un has called for the country to seize "absolute superiority" in drone and other military technology, and the drone program's gains are directly tied to the heists and the overseas IT worker schemes, Barnhart said.
The country is also aiding Russia’s war effort, he added.
“North Korea has sent troops, munitions, and weapons components to Russia, all funded through the same system, which is why a crypto hack is a national security issue and not only a problem for the exchange that got hit,” Barnhart said.
(Reporting by AJ Vicens in Detroit and Simon Lewis in Washington.)
