A hacking group linked to North Korea is widely believed to be behind the theft of $6.3 billion from cryptocurrency giant Binance, a cyberattack that experts describe as the largest cryptocurrency heist on record.
Researchers from blockchain intelligence firms TRM Labs and Chainalysis have attributed the attack to a North Korean cyber operation known as TraderTraitor, a group long associated with sophisticated financial crimes targeting cryptocurrency companies and technology firms.
According to cybersecurity specialists, the theft represents the latest chapter in a years-long campaign that has generated billions of dollars for North Korea's government and, according to Western authorities, helped fund military, nuclear and ballistic missile programmes.
The theft from Binance surpasses previous major cryptocurrency breaches and adds to an already vast tally attributed to North Korean cyber actors.
Chainalysis estimated in a report published late last year that North Korean groups had stolen at least $6.75 billion in cryptocurrency by the end of 2025.
That figure included the $1.5 billion theft from the ByBit exchange in February 2025.
Researchers say the group's activity did not stop there.
A separate attack on cryptocurrency platform Bitget in September resulted in the theft of $387 million, according to cybersecurity experts.
Michael Barnhart, a researcher at cybersecurity company DTEX, said the latest Binance breach brings the minimum amount of cryptocurrency linked to North Korean theft operations to approximately $13.5 billion.
Binance said it was working alongside industry partners and investigators to trace the stolen assets.
The company reported that approximately $3 billion worth of cryptocurrency linked to the theft has already been identified and efforts are under way to freeze or recover as much of it as possible.
“After Bitget, a lot of the community expected something like this,” Barnhart said.
Security researchers say TraderTraitor differs from many criminal groups because of its patience and ability to infiltrate organisations over long periods.
The group was highlighted in a 2022 joint warning issued by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the U.S. Treasury Department.
According to that warning, the hackers use malware, social engineering and deceptive recruitment campaigns to gain access to targeted organisations.
One of their most effective tactics involves posing as recruiters and offering fake job opportunities to software developers and IT professionals.
Victims are persuaded to participate in fictitious interviews and download malicious files, giving hackers access to login credentials and internal systems.
Barnhart described TraderTraitor as North Korea's most capable financial cyber operation.
“TraderTraitor is North Korea's most capable hacking group with a primary focus on financials and one staffed by some of the most experienced operators in the regime's cyber programs,” he said.
Rafe Pilling, a senior threat researcher at Sophos, said details emerging from the Binance breach closely match methods that have repeatedly been associated with North Korean cyber groups.
“This group in particular are somewhat artists in terms of getting into these distributed finance companies,” Pilling said.
He added that the hackers have become highly skilled at understanding the internal financial procedures companies use to authorise large transactions.
Cybersecurity experts and government officials say the proceeds from these operations extend far beyond financial gain.
Barnhart said stolen cryptocurrency is commonly transferred to Chinese organised crime networks involved in money laundering before eventually finding its way back to North Korea.
Western governments argue that the funds are used to support Pyongyang's military ambitions.
According to a recent advisory from the FBI, North Korean operatives also secure covert jobs at technology and financial firms abroad, generating income and gathering sensitive information for the government.
The FBI said proceeds generated by both the worker schemes and cyber thefts help finance North Korea's military activities.
A spokesperson for the U.S. State Department described North Korean cybercrime as a global security challenge.
“North Korea has increasingly turned to cybercrime to circumvent international sanctions and fund its unlawful weapons of mass destruction and ballistic missile programs,” the spokesperson said.
The official added that cryptocurrency theft and laundering have become a central element of that strategy.
Experts say the issue extends well beyond the cryptocurrency industry.
North Korean leader Kim Jong Un has repeatedly called for major advances in military technology, including expanding drone capabilities.
Barnhart argued that funds generated through cybercrime play a direct role in supporting those ambitions.
He also linked the financing mechanism to North Korea's broader military support for Russia.
“North Korea has sent troops, munitions, and weapons components to Russia, all funded through the same system, which is why a crypto hack is a national security issue and not only a problem for the exchange that got hit,” Barnhart said.
As investigators continue tracing the stolen funds, security specialists warn that cryptocurrency companies remain prime targets for sophisticated state-backed cyber groups seeking access to vast amounts of digital assets.
Australia has returned two ancient stone statue heads to China, more than 30 years after they were taken from imperial tombs in central China....
The Financial Action Task Force (FATF), the global body responsible for monitoring money laundering and terrori...
The death toll from the ongoing Ebola outbreak in the Democratic Republic of Congo has surpassed 5,000, accordi...
The Middle East conflict remains tense as diplomatic efforts continue alongside renewed Houthi attacks. Iran says it remains open to mediation, while the Saudi-led coalition says it intercepted a ballistic missile fired towards the kingdom.
Evacuations and the provision of humanitarian aid in the Russian-occupied southern Ukrainian town of Oleshky have begun, a senior Ukrainian official said on Friday. In a statement on Telegram, David Arakhamia said a six-day ceasefire was holding, and that more details would follow.
Rescuers searched the wreckage of two high-speed trains in central Spain on Thursday as the death toll rose to a provisional 74, making it the country's second fatal high-speed rail disaster this year.
Russian President Vladimir Putin said Russia remains willing to rebuild relations with European countries but warned that any wider conflict on the continent would leave no winners, as he commented on recent diplomatic contacts with Nordic leaders and growing security concerns in the Baltic region.
Qatari mediators returned to Tehran on Friday as part of efforts to reach a deal between the U.S. and Iran, according to an official briefed on the talks.
The Financial Action Task Force (FATF), the global body responsible for monitoring money laundering and terrorist financing risks, has removed four countries from its so-called “grey list” after determining they had made sufficient progress in addressing weaknesses in their financial cr
The death toll from the ongoing Ebola outbreak in the Democratic Republic of Congo has surpassed 5,000, according to government figures released on Friday, as health authorities continue to struggle to contain the country's worst-ever Ebola epidemic.
Poland's long-running conflict over judicial independence and control of the Constitutional Tribunal intensified on Friday after the head of the country's top court was suspended, prompting President Karol Nawrocki to cut short an overseas trip and return to Warsaw amid mounting political tensions.
China’s GJ-21 carrier-based stealth reconnaissance and strike drone has completed its first take-off and landing on board the Sichuan, the country’s first Type 076 amphibious assault ship, state media reported on 30 October.
A powerful El Niño is driving extreme weather worldwide, leaving millions facing drought, wildfires and destructive storms as governments scramble to respond to the growing crisis.
You can download the AnewZ application from Play Store and the App Store.
What is your opinion on this topic?
Leave the first comment