Key Takeaways
- • North Korean state-linked hackers have used cryptocurrency theft as a major source of foreign currency, with a UN panel of experts reviewing 58 suspected cyber-attacks on crypto-related companies between 2017 and 2023 worth about $3bn, which the panel estimated generated roughly half of North Korea's foreign currency income.
- • Experts including TRM Labs quickly attributed the $6.3bn (£4.7bn) Binance cryptocurrency theft to TraderTraitor, also known as the Lazarus Group, though the link has not yet been proven.
- • The FBI attributed the $1.5bn Bybit exchange theft in February 2025, the largest previous crypto hack, to TraderTraitor.
- • Ciaran Martin, former head of the UK's National Cyber Security Centre, argues North Korea targets crypto because lightly regulated crypto firms have weaker defences than traditional banks, which have largely avoided losses above $100m from cyber-attacks over the past decade.
- • The 2016 Bangladesh Bank heist, in which hackers attempted to move $951m and stole $81m, remains one of the last large cyber thefts from a traditional bank attributed to North Korea.
Summary
The Guardian reports that North Korea, a heavily sanctioned and economically isolated state, has relied on some of the world's most sophisticated hacking to generate foreign earnings. Kim Jong-un's government controls an estimated stockpile of about 50 nuclear warheads and has supplied troops and weapons to Russia in its war in Ukraine, while 40% of the population is undernourished according to the UN.
A UN panel of experts, reporting to the Security Council, said in spring 2024 that it was reviewing 58 suspected cyber-attacks by North Korea on cryptocurrency-related companies between 2017 and 2023, worth around $3bn. The panel estimated the proceeds generated half of North Korea's foreign currency income. One unnamed country went further, estimating the stolen funds finance 40% of the country's weapons of mass destruction programmes. The suspected crypto hacks reached as many as 17 in 2023 alone, with thefts valued at $750m, and the sums involved are increasing.
The $6.3bn Binance theft was quickly attributed by experts such as TRM Labs to TraderTraitor, the elite North Korean unit also known as the Lazarus Group, though the Guardian notes the link may not be proven. The FBI attributed the February 2025 $1.5bn Bybit hack to the same group. Former NCSC head Ciaran Martin argues that North Korea targets crypto because the fast-growing, lightly regulated sector has yet to match the sophisticated defences developed by traditional banks. Martin said hackers have taken nine- or 10-figure sums from crypto hacks on more than 30 occasions over the past decade, while traditional banks suffering losses above $100m from cyber-attacks in the same period numbered zero or one.
The Guardian recalls the 2016 Bangladesh Bank attack, in which North Korean hackers attempted to move $951m from an account held at the Federal Reserve Bank of New York, exploiting time-zone differences. Most transfers were halted, and $81m was ultimately stolen. The article also notes a 2019 attempt to take control of cash machines linked to 56 financial institutions, which British officials detected and which was suppressed without media coverage.
The report places these operations within North Korea's broader record of illicit revenue generation, including supernote counterfeiting in the 1990s and crystal meth production in the 2000s. Hacking units such as Lazarus operate under the Reconnaissance General Bureau spy agency and recruit top students, despite severe internet restrictions for the general population.
A UN panel of experts, reporting to the Security Council, said in spring 2024 that it was reviewing 58 suspected cyber-attacks by North Korea on cryptocurrency-related companies between 2017 and 2023, worth around $3bn. The panel estimated the proceeds generated half of North Korea's foreign currency income. One unnamed country went further, estimating the stolen funds finance 40% of the country's weapons of mass destruction programmes. The suspected crypto hacks reached as many as 17 in 2023 alone, with thefts valued at $750m, and the sums involved are increasing.
The $6.3bn Binance theft was quickly attributed by experts such as TRM Labs to TraderTraitor, the elite North Korean unit also known as the Lazarus Group, though the Guardian notes the link may not be proven. The FBI attributed the February 2025 $1.5bn Bybit hack to the same group. Former NCSC head Ciaran Martin argues that North Korea targets crypto because the fast-growing, lightly regulated sector has yet to match the sophisticated defences developed by traditional banks. Martin said hackers have taken nine- or 10-figure sums from crypto hacks on more than 30 occasions over the past decade, while traditional banks suffering losses above $100m from cyber-attacks in the same period numbered zero or one.
The Guardian recalls the 2016 Bangladesh Bank attack, in which North Korean hackers attempted to move $951m from an account held at the Federal Reserve Bank of New York, exploiting time-zone differences. Most transfers were halted, and $81m was ultimately stolen. The article also notes a 2019 attempt to take control of cash machines linked to 56 financial institutions, which British officials detected and which was suppressed without media coverage.
The report places these operations within North Korea's broader record of illicit revenue generation, including supernote counterfeiting in the 1990s and crystal meth production in the 2000s. Hacking units such as Lazarus operate under the Reconnaissance General Bureau spy agency and recruit top students, despite severe internet restrictions for the general population.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.