North Korean hackers stole billions, the FBI says. It’s not their first heist

[NEW YORK] The Federal Bureau of Investigation (FBI) said on Saturday (Oct 31) that North Korea was responsible for the hacking attack on Binance this past week, the first official acknowledgment of the regime’s role in the biggest cryptocurrency heist in history.

Poor, isolated and heavily sanctioned, North Korea is not a country you would expect to field an elite army of hackers capable of pulling off billion-dollar heists.

But for years, security officials had warned that the regime’s cyberattacks were becoming increasingly sophisticated, looting enormous sums to support North Korea’s military and nuclear weapons programme.

Those fears peaked when Binance, the world’s largest crypto exchange, announced on Thursday that hackers had made off with some US$6 billion.

The FBI on Saturday accused the North Korean hacking unit TraderTraitor of carrying out the attack, which crypto research firms said made use of asset laundering patterns that had not been seen before.

The specifics of the attack are still being established. Binance initially said the hackers might have compromised an engineer’s laptop, leading to unauthorised withdrawals.

But in an update Friday, the company said it had identified “additional points of breach”. The FBI said it had observed TraderTraitor actors converting stolen assets into ethereum.

Powered by a pipeline of top-class programming students, North Korea’s hacking units have for years penetrated banks and companies and capitalised on the rise of crypto.

A UN panel in 2024 found the regime’s cyberattacks had generated about half its foreign currency income, amounting to billions in revenue. Experts agree that the regime is now one of the biggest and most capable cyber threats in the world.

SEE ALSO

Crypto exchanges call for quick moves to bolster defences after Binance heist

Millions of hacking attempts as companies, governments rush to patch PHP flaws

Beyond the breach: Legal risks following cyber incidents

Here is a look at some of North Korea’s most famous earlier hacks.

2014: The Sony attack

In 2014, tech and media giant Sony Pictures was preparing to release The Interview, a far-fetched comedy about the assassination of the North’s leader.

Then, US officials said, hackers associated with the Lazarus Group, a shadowy hacking syndicate backed by the North Korean government, breached the company’s computers. (The bureau has said Lazarus and TraderTraitor are both fronts for the same regime-backed hackers.)

The attacks caused the leaks of internal documents containing salary information that humiliated top company officials and stole terabytes of data.

North Korea has never formally taken responsibility for the attack. At the time, however, Kim Jong Un, the country’s dictator, called the film an “act of terrorism”.

2016: Custom malware

In 2016, North Korean hackers tried to steal about US$1 billion from the Federal Reserve Bank of New York. Only a spelling error stopped them.

Using a payment messaging system known as Swift, the hackers were able to persuade the New York Fed to move money to accounts in the Philippines.

The hackers were looting an account of the Bangladesh Central Bank when bankers grew suspicious about a withdrawal request that had misspelled “foundation” as “fandation”.

Still, the hackers made off with US$81 million.

The attack was important because it showed how savvy North Korean hackers were becoming.

In contrast to off-the-shelf tools that had been used in other attacks at the time, the malware the thieves devised for this heist was a custom code, configured for a specific bank. Written from scratch, it was unfamiliar to existing virus-protection programmes.

Crypto booms and busts

As the cryptocurrency market boomed in the mid 2010s, North Korea began targeting firms in the industry, escalating to large-scale attacks on crypto exchanges by 2020, according to a North Korea-focused publication of the Stimson Center, a Washington-based think tank.

North Korean hackers were accused of stealing $571 million from crypto exchanges between January 2017 and September 2018 and $316 million from 2019 to November 2020.

With borders shut because of the coronavirus pandemic and traditional banks strengthening their firewalls against hackers, cryptocurrency theft was becoming an increasingly vital source of foreign currency for the regime.

In 2022, the US publicly accused the Lazarus Group of stealing US$620 million in cryptocurrency from video game Axie Infinity.

That year, North Korea’s haul was a little under US$1 billion, according to Chainalysis, a crypto analytics firm, which found 50 per cent of the industry’s yearly losses were from North Korean hacks.

Given the history of spectacular market crashes, crypto is hardly a stable source of funding.

But at a time when North Korea had locked itself down during the pandemic, hacking crypto exchanges allowed it to generate income in ways that were both Covid-safe and harder to trace in an industry subject to limited government oversight.

2025: The Bybit attack

In February 2025, North Korean hackers pulled off what was then the biggest heist in the crypto industry’s history, stealing US$1.5 billion in cryptocurrencies, according to the FBI.

To pull off the breach, the hackers exploited cryptocurrency exchange ByBit’s reliance on a free software product.

The North Korean hackers had tricked the CEO of Bybit, Ben Zhou, into authorising a seemingly routine transaction that handed them control of the exchange’s system.

After looting Bybit, the North Korean hackers spread the stolen funds across a vast web of online crypto wallets, a money laundering strategy that they had also employed after other heists. NYTIMES