In this article
North Korean hackers are likely behind the record $6.3 billion Binance theft from cryptocurrency exchange Binance, according to blockchain investigators and cybersecurity researchers. The suspected operation matters beyond Binance: experts say proceeds from crypto thefts and overseas technology-worker schemes help North Korea finance nuclear, military and weapons programs.
Key Takeaways
- TRM Labs and Chainalysis attributed the $6.3 billion Binance theft to the North Korean group TraderTraitor.
- Chainalysis said North Korea had stolen at least $6.75 billion in cryptocurrency through the end of 2025.
- US officials say North Korean cybercrime helps fund nuclear, military and ballistic-missile programs.
TRM Labs and Chainalysis linked the Binance attack to TraderTraitor, a group associated with North Korean hackers and identified in a 2022 joint warning from the FBI, the Cybersecurity and Infrastructure Security Agency (CISA) and the US Treasury. Binance and other parties have been working to freeze some of the stolen funds, with about $3 billion located so far, according to the report. AsiaOne reported the findings on Oct. 31, citing comments made by experts on Oct. 30.
Why the Binance theft points to TraderTraitor
TraderTraitor is the name used for a hacking group that targets cryptocurrency companies, particularly their developers and information-technology staff. The FBI, CISA and Treasury described the group in 2022 as using malicious software and other methods to compromise people who work on cryptocurrency systems.
The Binance connection remains an attribution by investigators rather than a conclusive public finding described in the source. TRM Labs and Chainalysis made the link, identifying North Korean hackers as likely responsible, while Rafe Pilling, a senior director of threat research at Sophos, said early reports about the Binance compromise resembled the North Korean playbook.
Michael Barnhart, a researcher at cybersecurity firm DTEX, described TraderTraitor as North Korea’s “most capable hacking group with a primary focus on financials.” He also linked it to experienced operators from the former APT38 ranks, referring to North Korea’s long-running financially focused hacking units.
The Binance incident is part of a wider pattern. North Korean hackers also took $387 million from the Bitget exchange in September, according to experts cited in the report. Chainalysis said North Korea had stolen at least $6.75 billion in cryptocurrency through the end of 2025, including the $1.5 billion ByBit exchange hack in February 2025.
How North Korean hackers get inside crypto companies
The reported attacks often begin with people rather than blockchain code. Researchers say North Korean hackers target developers and IT staff through fake job offers, recruitment scams and phony interviews. A candidate may be persuaded to download malicious software, giving attackers access to login credentials and other sensitive information.
That access can expose the systems used to manage digital assets. Attackers can study who approves transfers, how transactions are reviewed and where valuable permissions are held. Pilling said the group is particularly skilled at understanding how a company’s employees and systems authorize money movements.
For a hypothetical example, a fake interview could lead a developer to install a program presented as part of a technical assessment. If that program exposes login information, attackers could use the access to learn how the exchange handles transfers. The source does not describe this hypothetical sequence as the exact Binance method; it explains the type of social engineering researchers associate with TraderTraitor.
The technique is significant because cryptocurrency companies distribute control across employees, software systems and approval processes. A successful intrusion may therefore involve manipulating the organization around a wallet or exchange, rather than breaking a cryptographic safeguard.
Newsletter
Get the VaidikX AI Brief
The week's biggest AI, Big Tech and startup news, explained in 5 minutes. Free, every week.
Billions stolen and the laundering network behind them
Experts cited in the report estimate that North Korea’s minimum cryptocurrency theft total has reached roughly $13.5 billion. That figure includes the $6.75 billion identified by Chainalysis through the end of 2025, the $387 million Bitget theft and the $6.3 billion Binance incident, although the source presents the overall total as an expert estimate rather than a single independently verified ledger.
Barnhart said stolen funds are passed to Chinese organized-crime money-laundering groups. Laundering is the process of moving illicit proceeds through additional people, wallets or transactions to make their origin harder to trace. Binance said it and others were trying to freeze part of the stolen cryptocurrency, and about $3 billion had been located.
The speed and scale of the Binance incident are described in more detail in the reported $6.3 billion Binance crypto hack. The recovery effort illustrates a central feature of digital-asset theft: investigators can track funds on public blockchains, but identifying controllers and stopping transfers still requires cooperation from exchanges and other participants.
Why it matters for US readers
North Korean hackers affect US readers because the targets, workers and financial channels involved are international. The FBI said in an Oct. 13 public service announcement that North Koreans secretly take jobs at technology and financial companies in the United States and other countries, using those positions to earn money for the North Korean government and steal sensitive data.
The FBI said money raised by overseas IT workers and North Korean hackers helps fund North Korean nuclear and military programs. A US State Department spokesman called North Korean cybercrime a “global problem” and said the country has increasingly used cybercrime to evade international sanctions and finance unlawful weapons-of-mass-destruction and ballistic-missile programs.
For US companies, the warning extends beyond cryptocurrency exchanges. Technology and financial businesses may also face recruitment scams aimed at employees, applicants and contractors. The source does not provide a specific defense checklist or say that every fake job offer is connected to North Korea, but it shows why hiring processes and developer access can become part of a national-security risk.
Why crypto theft has become a national-security issue
The reported financial losses are large, but experts say the destination of the money is the more serious concern. Barnhart said the same system supports North Korea’s weapons efforts and its aid to Russia’s war effort, including troops, munitions and weapons components.
He also said North Korean leader Kim Jong-un has called for “absolute superiority” in drone and other military technology, and that gains from the country’s drone program are directly tied to crypto heists and overseas IT-worker schemes. Those claims come from Barnhart and are not presented in the source as an independently quantified assessment.
That distinction matters. TRM Labs and Chainalysis attributed the Binance theft to TraderTraitor, while the links to weapons programs reflect statements from US officials and cybersecurity researchers. What is clear from the reported pattern is that North Korean hackers use financially motivated cyber operations as part of a broader state strategy, making exchange security, employee vetting and money tracing concerns that reach well beyond the crypto industry.
Source: AsiaOne
More from VaidikX
