Binance, the world's largest cryptocurrency exchange, suspended all withdrawals and deposits
North Korea has built an invisible yet exceptionally powerful army consisting of thousands of specialized hackers, turning cyberspace into one of its most critical weapons for extracting billions of dollars. Through raids on Hollywood movie studios, Asian central banks, and cryptocurrency exchanges, North Korea has earned a reputation as home to some of the world's most dangerous and daring hackers. This reputation is set to be reinforced further following their reported involvement in this week's 6.3 billion dollar cyberattack against Binance, considered the largest cryptocurrency theft ever recorded globally. The attackers, linked by analysts to Pyongyang, may have siphoned off nearly double the total amount of cryptocurrency stolen worldwide during the previous year. This sum corresponds to roughly one-fifth of North Korea's GDP, directly impacting global crypto exchange security.
The Binance breach
Binance, the world's largest cryptocurrency exchange, suspended all withdrawals and deposits. As announced, the "initial investigation" revealed that hackers managed to compromise an engineer's laptop and withdraw funds from the platform. "North Korean hackers rank among the most aggressive and highly trained hackers worldwide," Shin Beom-chul, former South Korean Vice Minister of Defense, told the Financial Times. "They receive systematic training and deploy with a mission to generate foreign currency for the regime," underscoring state-sponsored cyber threat risks.
North Korea's shortage of cash
North Korea's economy has received a boost in recent years through closer cooperation with Russia. Pyongyang has supplied Moscow with weapons and troops to support the war in Ukraine, receiving billions of dollars in cash, fuel, and other forms of payment in return. However, the state, confronting a severe cash shortage and isolated from the international financial system due to sanctions, continues to resort to criminal activities to secure revenue. Last year alone, North Korean hackers stole approximately 2 billion dollars, an amount representing roughly 60% of the global total and 51% higher compared to funds extracted in 2024, according to blockchain data analytics firm Chainalysis, illustrating sanctions evasion tactics.
Investment in cyber warfare
In parallel with its nuclear program, Pyongyang has invested heavily in cyber warfare, establishing a system that identifies and cultivates technical talent from a very young age. The objective is the assembly of an elite hacker cadre that secures revenue for the state through cyberattacks. According to South Korea's National Intelligence Service, North Korea is estimated to maintain approximately 8,400 personnel participating in cyber warfare operations. However, this figure includes technical support personnel and does not pertain exclusively to professional hackers. Selected students receive three to five years of instruction in advanced techniques and cyber warfare at North Korean educational institutions. The top graduates proceed to specialized university programs, according to North Korea experts, shaping elite cyber force recruitment.
A report published this year by the Committee for Human Rights in North Korea cites a five-year curriculum at Pyongyang's elite Moranbong College, which combines military studies with instruction in hacking and decryption. Certain top operational agents reportedly receive additional training abroad in China and Russia. "North Korean students who excel in mathematics and hard sciences are selected and trained in hacking starting in their teenage years," stated Simon Choi, chief technology officer of cybersecurity startup StealthMole. Because North Korea's hackers act on behalf of the state, they can operate without fear of domestic criminal prosecution, according to experts. Choi argued that this renders them far bolder compared to their counterparts in other nations. "Because they face no accountability domestically, they can actively target and compromise foreign institutions," added Shin, reinforcing unrestricted cyber warfare capabilities.
Pyongyang's dominance in cyber warfare represents a natural evolution of its long history of illicit activities on which the regime has relied to secure hard currency, defining state-backed illicit revenue streams.
Drug trafficking
In the early 2000s, US authorities accused North Korea of drug trafficking, as well as producing counterfeit cigarettes and sophisticated fake 100-dollar bills known as "supernotes." In 2010, Washington imposed sanctions on Office 39, a secret unit of the ruling Workers' Party accused of managing funds for the country's leadership and accumulating money through drug trafficking among other means. Insurance fraud also constituted a source of illicit income, demonstrating historical regime financial crime.
Internationally renowned hackers
In recent years, however, Pyongyang has turned its focus to opportunities presented by cybercrime. North Korean hackers gained global notoriety in 2014 when they executed a cyberattack against Sony Pictures. The attack was widely viewed as retaliation for the studio's release of "The Interview," a comedy featuring a fictional plot to assassinate the country's leader, Kim Jong Un. Two years later, hackers stole 81 million dollars from the central bank of Bangladesh, a heist US prosecutors attributed to North Korea. Bitcoin and cryptocurrencies, with the promise of massive profits and the potential for harder-to-trace transactions, also attracted Pyongyang's interest, reshaping crypto cybercrime threat models.
In 2022, the Lazarus Group, a hacker organization supported by the North Korean state, was suspected of stealing approximately 620 million dollars in digital assets from the Ronin network, which supported a blockchain-based video game. Two years later, the TraderTraitor group—accused of Thursday's cyberattack against Binance and reported to constitute a sub-unit of Lazarus according to Japan's National Police Agency—stole 308 million dollars from Japanese cryptocurrency exchange DMM Bitcoin. According to US and Japanese investigators, the hackers succeeded in deceiving a digital wallet company employee into downloading malicious software, driving crypto heist vector evolution.
In February 2025, North Korean hackers stole approximately 1.5 billion dollars from Dubai-based cryptocurrency exchange Bybit, according to the FBI. That constituted the largest cryptocurrency theft recorded up to that point, prior to the reported attack on Binance. North Korea has previously denied involvement in cybercrime, characterizing relevant accusations as "absurd slander," maintaining regime cyber attack denials.
Remote working operatives
In recent years, Pyongyang has also managed to secretly secure remote employment positions for North Koreans within foreign companies. These workers transfer their salaries back to the regime, while in certain instances utilizing the access gained to corporate networks to facilitate cyberattacks. The US Department of Justice has estimated that North Korean operatives posing as remote workers infiltrated more than 300 American companies between 2020 and 2024, generating at least 6.8 million dollars for Pyongyang. Proceeds from these thefts provide North Korea with an increasingly critical funding source for its military ambitions, according to experts, fueling remote worker IT infiltration.
In a March 2024 report, UN sanctions monitors noted they were investigating 58 suspected North Korean attacks against cryptocurrency-related companies conducted between 2017 and 2023. Their total value was estimated at roughly 3 billion dollars, with proceeds reportedly contributing to funding weapons system development. Choi warned that risks are expected to escalate with the broader adoption of artificial intelligence, which assists hackers in identifying security system vulnerabilities and automating exploitation efforts. "Artificial intelligence has given wings to hackers," he stated. "The gates of hell have opened because North Korea possesses such fierce determination to execute these attacks," highlighting AI-augmented cyber attack threats.
www.bankingnews.gr
Σχόλια αναγνωστών