North Korean hackers siphon billions from crypto exchanges, fueling weapons programmes
A string of high‑value cryptocurrency thefts traced to the Lazarus Group is estimated to provide half of North Korea’s foreign‑currency income.
Massive crypto heist tied to North Korean hackers
Security firm TRM Labs quickly attributed the $6.3 billion Binance theft to TraderTraitor, an elite hacking unit also known as the Lazarus Group. The link, while not yet proven in court, matches the group’s established pattern of targeting cryptocurrency platforms.
Historical backdrop of crypto theft
North Korea’s foray into cryptocurrency theft dates back to 2017, exploiting the sector’s relatively lax security to generate revenue for its military, including its nuclear weapons programme.
Scale of the cyber‑campaign
A panel of experts reporting to the UN Security Council in spring 2024 said it was reviewing 58 suspected cyber‑attacks on cryptocurrency‑related companies between 2017 and 2023, amounting to $3 billion. The panel estimated that such illicit proceeds generate half of the country’s foreign‑currency income.
One unnamed country went further, estimating that the stolen billions fund 40 % of the weapons of mass destruction programmes.
In 2023 alone, as many as 17 crypto hacks were suspected, with thefts valued at $750 million, and the sums involved are only increasing.
Comparison with traditional banking attacks
Ciaran Martin, former head of the UK’s National Cyber Security Centre, notes that North Korea appears to favor crypto because traditional banks have built sophisticated defences that the fast‑growing, lightly regulated crypto sector lacks. Over the last decade, hackers have walked off with nine‑ or 10‑figure sums from crypto hacks on more than 30 occasions. The number of traditional banks who have suffered a loss of more than $100 m as a result of a cyber‑attack in the same period is zero or one, he said.
The regime’s last major attack on a traditional bank was the February 2016 Bangladesh Bank incident, where hackers attempted to move $951 million from an account at the Federal Reserve Bank of New York. A series of mishaps, including a transfer to an intermediate account in the Philippines and a hold‑up at a bank on Jupiter Street, limited the loss to $81 million.
Other illicit activities
North Korea has also been accused of forging high‑quality $100 “supernotes” in the 1990s and producing and trafficking crystal meth for export in the 2000s.
Limited domestic internet access
Despite the regime’s heavy reliance on cyber‑crime, internet access within North Korea remains severely restricted for the general population. Maths and science are emphasized in schools, and top university students are recruited into hacker groups like Lazarus, which operate under the Reconnaissance General Bureau spy agency.
Recent high‑profile crypto hack
The world’s largest previous crypto hack occurred in February 2025, when $1.5 billion was stolen from the Bybit exchange, an operation the FBI attributed to TraderTraitor.
UK incidents
The United Kingdom has been rarely targeted. In 2019, North Korean hackers attempted to control cash machines linked to 56 financial institutions to force excessive payouts. British officials detected the scheme, alerted the banks, and the hack was quietly suppressed without media coverage.
North Korea’s cyber‑theft enterprise continues to evolve, feeding a regime that relies on illicit finance to sustain its weapons ambitions.
