Dan SabbaghDefence and security editor
Cryptocurrency theft is estimated to generate half of the country’s foreign currency income
North Korea plays by its own rules. The isolated, secretive and autocratic country is largely cut off from the world’s economic system – but when it comes to generating foreign earnings it relies on some of the world’s most sophisticated hacking.
Experts, such as TRM Labs, quickly attributed the extraordinary $6.3bn (£4.7bn) Binance cryptocurrency theft to TraderTraitor, an elite North Korean hacking unit that has also been known as the Lazarus Group. Though the link may not be proven yet, the pattern of behaviour is familiar.
North Korea has a history of cryptocurrency theft dating back to 2017, focusing on the sector’s relatively lax security controls as a way of stealing money and generating revenues for its military, including its nuclear weapons programme.
Kim Jong-un, its dictatorial ruler, controls a stockpile of about 50 nuclear warheads, and has been supplying troops and weapons to help Russia in its war in Ukraine. But North Korea is also extremely poor: 40% of the population are undernourished according to the UN and nearly one in five of its children are stunted.
A UN panel of experts, reporting to the security council, said in the spring of 2024 that it was reviewing “58 suspected cyber-attacks” by North Korea “on cryptocurrency-related companies between 2017 and 2023” worth $3bn.
The panel said the cash was estimated to generate half of North Korea’s foreign currency income. One unnamed country went further with its estimate: the stolen billions fund “40% of the weapons of mass destruction programmes”.
The suspected crypto hacks amounted to as many as 17 in 2023 alone: thefts valued at $750m, and disturbingly, the sums involved are only increasing. The world’s largest previous crypto hack took place in February 2025, when $1.5bn was stolen from the Bybit exchange – the work, the FBI said, of TraderTraitor.
Ciaran Martin, a former head of the UK’s National Cyber Security Centre, argues that North Korea appears to have targeted crypto because traditional banks have developed sophisticated defences that the fast-growing and lightly regulated sector has yet to match.
“Over the last decade, hackers have walked off with nine- or 10-figure sums from crypto hacks on more than 30 occasions. The number of traditional banks who have suffered a loss of more than $100m as a result of a cyber-attack in the same period is zero or one,” Martin said.
North Korea was behind one of the last large cyber thefts on a traditional bank – an attack on Bangladesh Bank in February 2016, where North Korean hackers tried to illicitly move $951m from an account the bank had with the Federal Reserve Bank of New York, taking advantage of time differences between the two.
A piece of luck prevented most of the money from being sent to an intermediate account in the Philippines. The corresponding bank was based on Jupiter Street, which shares its first word with the name of a sanctioned Iranian ship, so most of the transfers were held up. In the end, $81m was stolen.
The isolated state has long been accused of engaging in criminal activities to survive, including the forgery of high-quality $100 bills, known as “supernotes” in the 1990s, and the production and trafficking of crystal meth for export in the 2000s.
The UK has been rarely targeted. In 2019, North Korean hackers did try to take control of cash machines linked to 56 financial institutions to make them pay out sums well in excess of normal. British officials spotted what was afoot, alerted the banks and the hack was quietly suppressed with no media coverage.
The irony is that the internet in North Korea is severely restricted, with access denied to the general population. Maths and science are pushed at school, however, and at university some of the best students are recruited into hacker groups, such as Lazarus, operating under the auspices of the country’s Reconnaissance General Bureau spy agency.
Hacking is closely tied to the all-powerful state. In December 2014, it emerged, to the embarrassment of Sony Pictures, that film stars Jennifer Lawrence and Amy Adams were paid less than their male counterparts in American Hustle. It was one of thousands of embarrassing emails leaked from the Hollywood studio through a hack.
The attack, by North Korea’s Lazarus Group, was conducted because Sony had funded a film, The Interview: a Seth Rogen comedy that depicted the assassination of Kim Jong-un. Amid the chaos of the revelations, Sony tried to cancel the movie, then had to U-turn on its retreat, releasing it online and to a handful of cinemas, after being criticised for caving in to North Korean pressure.
Explore more on these topicsReuse this content
Source: www.theguardian.com
