A North Korean hacking group linked to a series of major cryptocurrency thefts is considered among the most prolific cybercriminals globally, according to cybersecurity experts. The group, known as "TraderTraitor," is believed to be behind a record $6.3 billion theft from Binance, one of the world’s largest cryptocurrency exchanges.
Blockchain analysis firms TRM Labs and Chainalysis have attributed the Binance heist, uncovered in 2026, to TraderTraitor, which the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the US Treasury first identified in a 2022 joint warning. The warning described how the hackers use malware and social engineering tactics, including fake job offers during purported recruitment interviews, to infiltrate software developers and IT personnel at cryptocurrency companies. This access enables them to steal login credentials and other sensitive data critical to executing large-scale thefts.
Chainalysis reported that North Korea stole at least $6.75 billion in cryptocurrency in 2025 alone, including a $1.5 billion hack of Bybit earlier that year. The group also targeted Bitget in September 2025, stealing approximately $387 million. Cybersecurity researcher Michael Barnhart of DTEX estimates that North Korean-linked hacks have cumulatively extracted about $13.5 billion from various cryptocurrency platforms.
Binance and other exchanges have been working to freeze stolen assets, recovering roughly $3 billion so far. Barnhart described TraderTraitor as North Korea’s “most capable hacking group,” staffed by experienced operators previously involved with the regime’s financial hacking units. The group focuses heavily on financial institutions, using sophisticated techniques beyond mere technical exploits to manipulate company systems and personnel approval processes for large cash transfers.
Rafe Pilling, senior director of threat research at Sophos, noted that the methods used in the Binance attack align closely with known North Korean tactics. He described the group as adept at understanding the internal operations of distributed finance companies and exploiting those weaknesses.
Beyond the thefts, the stolen funds are reportedly funneled through Chinese organized crime laundering networks. The FBI has also highlighted that North Korean operatives take covert roles within technology and financial companies worldwide, including in the United States, to steal data and generate revenue for the regime. The illicit proceeds are used to support North Korea’s nuclear weapons and ballistic missile programs.
A spokesperson for the US State Department described North Korean cybercrime as a growing global threat, noting that the regime increasingly relies on cybercrime to evade sanctions and finance its weapons of mass destruction programs. Cryptocurrency theft and laundering have become central to this strategy.
Barnhart added that North Korean leader Kim Jong Un has emphasized achieving dominance in drone and military technology, and that these cyberheists directly contribute to those efforts. He also linked the regime’s cyber operations to its support for Russia’s conflict in Ukraine, stating that funding from these illicit activities backs troop deployments, munitions, and weapons supply.
“Because the financial flows from these hacks support national security initiatives, such incidents transcend individual cryptocurrency exchanges and have broader geopolitical implications,” Barnhart said.