The Federal Bureau of Investigation (FBI) identified North Korea as the actor behind a recent cyberattack on Binance, the world’s largest cryptocurrency exchange, marking the first official attribution of the regime’s involvement in what is considered the largest crypto heist in history. The breach, which occurred last week, resulted in the theft of approximately $6 billion in digital assets.

North Korea, despite its economic isolation and extensive international sanctions, has developed a highly capable cyber operations unit known for executing sophisticated hacks targeting financial institutions and cryptocurrency platforms. According to the FBI, the hacking group known as Trader-Traitor orchestrated the Binance attack. Cybersecurity analysts noted that the group employed novel asset laundering methods not previously observed in similar thefts.

The investigation into the breach is ongoing. Initially, Binance reported that the hackers may have gained access by compromising an engineer’s laptop, enabling unauthorized withdrawals. However, by Friday, the exchange acknowledged multiple other breach points had been exploited. The FBI also reported that the perpetrators had converted stolen assets into Ethereum, a major form of cryptocurrency.

North Korea’s cyber operations have long targeted banks, financial firms, and increasingly, cryptocurrency exchanges. A 2024 United Nations panel concluded that cyberattacks generate roughly half of North Korea’s foreign currency income, amounting to billions of dollars annually. This revenue bolsters the country’s military and nuclear programs.

North Korean hackers have been linked to several high-profile cyber incidents over the past decade. In 2014, the Lazarus Group, a hacking collective associated with the regime, infiltrated Sony Pictures in retaliation for the planned release of "The Interview," a comedy depicting the assassination of North Korea’s leader. The attack exposed sensitive internal documents and resulted in massive data leaks.

Two years later, in 2016, North Korean hackers attempted to steal nearly $1 billion from the Federal Reserve Bank of New York. The scheme involved fraudulent transfer requests through the SWIFT financial messaging system to accounts in the Philippines. The operation was only thwarted when a suspicious typo—spelling "foundation" as "fandation" in a withdrawal order—raised alarms at the Bangladesh Central Bank. Despite the error, the hackers succeeded in stealing $81 million.

As the cryptocurrency market expanded in the late 2010s, North Korea intensified its focus on digital assets. Between January 2017 and November 2020, the regime was responsible for multiple thefts totaling nearly $900 million, according to research from experts monitoring the country’s cyber activities.

In February 2025, the regime carried out what was then the largest crypto exchange heist, targeting Bybit and stealing about $1.5 billion. This attack reportedly involved deceiving Bybit CEO Ben Zhou into authorizing a routine transaction that granted the hackers control over the exchange’s systems. Stolen funds were subsequently dispersed across an extensive network of online wallets, a laundering tactic repeatedly employed by the group.

With increasing scrutiny of traditional banking institutions and disruptions caused by the global pandemic, North Korea appears to be relying more heavily on cryptocurrency theft as a critical source of foreign currency revenue. The Binance attack underscores the persistent threat posed by state-backed cybercriminal groups operating in the cryptocurrency sector.