North Korean Hackers Linked to Record Crypto Heists

Cybersecurity experts state that North Korean hackers are among the most prolific crypto thieves in the world, having likely carried out a record $6.3 billion theft from cryptocurrency exchange Binance. Blockchain firms TRM Labs and Chainalysis trace the heist to a hacking group called "TraderTraitor." This same group was named in a 2022 joint advisory from the FBI, CISA and the US Treasury for targeting software developers and IT staff at crypto firms using malicious software and fake job interviews. Chainalysis reports that North Korea stole at least $6.75 billion in cryptocurrency through the end of 2025, a figure that includes a $1.5 billion hack on the ByBit exchange in February 2025. Experts add that the group also stole $387 million from the Bitget exchange in September, bringing North Korea's minimum total of stolen cryptocurrency to roughly $13.5 billion, according to DTEX researcher Michael Barnhart. Binance states that authorities and companies are working to freeze some of the stolen funds, having located about $3 billion so far.

Methods and Laundering

TraderTraitor is described as North Korea's most capable financial hacking unit, drawing experienced operators from older units like APT38. The group tricks tech workers by sending malware or setting up fake job interviews to steal login details and gain network access. Sophos senior threat research director Rafe Pilling notes that the hackers excel at figuring out how companies approve money transfers. Once the funds are stolen, the hackers transfer them to Chinese organised crime groups for money laundering, as noted by Barnhart.

Broader Impact

The FBI warns that North Korean workers secretly take remote jobs at tech and financial firms abroad to send money home and steal data. The US State Department describes North Korean cybercrime as a global issue used to bypass international sanctions and finance unlawful weapons of mass destruction and ballistic missile programs. Barnhart points out that funds from these hacks and IT schemes support North Korea's drone program and military tech goals, while also helping finance North Korean troop and munition shipments to aid Russia's war effort.

Context

State-backed cyber operations have increasingly become a primary revenue source for governments facing severe international economic isolation and strict trade sanctions. Because cryptocurrency transactions are difficult to trace and recover once moved through illicit laundering networks, major digital asset exchanges remain frequent high-value targets for advanced persistent threat groups.