North Korean hackers steal billions through cyber operations, report says
State-sponsored hackers use social engineering and cryptocurrency theft to generate revenue for Pyongyang despite international sanctions.
North Korean state-sponsored hackers have built a billion-dollar cyberwar machine to target global financial institutions and steal cryptocurrency, according to the Times of India.
The hacking operations allow Pyongyang to generate revenue despite sweeping international sanctions. Blockchain intelligence firms TRM Labs and Chainalysis said the October 29 attack on Binance bears the hallmarks of TraderTraitor, a North Korean-linked operation.
TraderTraitor has been associated with the Lazarus Group and other North Korean-linked cyber units. In April 2022, the US Federal Bureau of Investigation identified TraderTraitor as a North Korean state-sponsored advanced persistent threat group.
The FBI previously attributed the $100 million Atomic Wallet theft in June 2023 and the $60 million Alphapo theft in July 2023 to TraderTraitor-affiliated actors. In August 2023, the agency said it tracked approximately 1,580 Bitcoin stolen in multiple heists by the group.
Hackers often use social engineering and fake identities to infiltrate companies. They approach employees on professional networking platforms by posing as recruiters and persuading targets to download malicious applications disguised as trading tools.
A November 2025 report by the Multilateral Sanctions Monitoring Team said Pyongyang uses cryptocurrency theft and money laundering to fund weapons of mass destruction and ballistic missile programmes. Reuters reported on October 30 that North Korea had stolen at least $6.75 billion in cryptocurrency through 2025.