North Korean Cybercriminals Carry Out the Largest Crypto Hack in History

Today’s bank robbers carry out cryptocurrency heists, with the best in the business hailing from North Korea. The FBI formally blamed Pyongyang for a $6.3 billion hack of the Binance exchange at the end of October — the largest theft in the history of cryptocurrency. The North Korean hacking group known as TraderTraitor executed the attack, beating its prior record of $1.5 billion during a February 2025 hack of another crypto exchange, Bybit. These volumes dwarf North Korea’s total global trade, providing the regime with viable income streams to keep its nuclear and missile program in the black. Billions Gone in Minutes The hackers accessed cryptocurrency wallets owned by Binance itself (not its customers) and quickly drained the funds. In the space of 20 minutes, the hackers made off with roughly $6.3 billion in various currencies. They then laundered the funds through multiple wallets and mixers, transferring between different cryptocurrencies to obscure the trail. Within about three hours, the industry froze about $2.7 billion in stablecoins, preventing North Korea from making off with the entire loot. Unlike other forms of cryptocurrency, stablecoins are pegged to the dollar and backed by reserves of the issuing company. While the FBI’s alert about the hack and information from blockchain analysis firms can identify the wallets the hackers are using to move the rest of the money, Binance may not be able to recover it. Cybercrime Funds the Regime A UN panel of experts on North Korea’s nuclear program and sanctions evasion warned back in March 2024 that crypto thefts “help to fund the country’s development of weapons of mass destruction.” Crypto-analysis firm TRM Labs reported that North Korea was to blame for 76 percent of all crypto losses between January and April of this year. Crypto hacks are not the only cyber operation the regime uses to generate illicit income. The same UN panel warned that Pyongyang may have earned $250 to $600 million annually through a fraud scheme involving North Koreans posing as Western IT workers to secure jobs at large firms. These individuals send their salaries back to the regime. North Korea’s IT workers “weaponize sensitive data and extort businesses for substantial payments,” Secretary of the Treasury Scott Bessent warned on October 28 as the department issued yet another round of sanctions on Russia- and China-based individuals and companies involved in the IT workers scheme. Punish the Hackers and Their Backers In addition to Treasury’s sanctions, the Department of Justice has issued dozens of indictments against North Korean, Russian, and Chinese nationals and others responsible for facilitating Pyongyang’s schemes. As private blockchain analysis firms continue tracking the movement of the latest stolen funds, Treasury and law enforcement officials should use the information to build additional cases. U.S. law enforcement should work closely with Seoul’s Korean National Police given that Pyongyang’s hackers have also hit South Korean crypto exchanges. Treasury should also sanction the Chinese financial institutions North Korea uses to launder the proceeds from its schemes. While Treasury has not publicly named specific Chinese financial institutions, its press releases note ongoing sanctions evasion between North Korea and China and Chinese yuan-denominated transactions. A 2020 case against Chinese nationals Tian Yinyin and Li Jiadong for laundering North Korean funds meanwhile mentioned accounts at China Guangfa Bank, which has not faced U.S. penalties. Even if hackers pass cryptocurrencies through multiple wallets, mixers, and exchanges, they often still have to convert the funds into fiat currencies. Preventing that last step means that even if the regime has a lot of money on paper — or on the blockchain — it cannot buy materials for its weapons program. Mathew Ha is an adjunct fellow at the Center on Cyber and Technology Innovation (CCTI) at the Foundation for Defense of Democracies (FDD). Annie Fixler is CCTI’s director and an FDD senior fellow. For more analysis from the authors and FDD, please subscribe HERE. Follow FDD on X @FDD and @FDD_CCTI. FDD is a Washington, DC-based, nonpartisan research institute focusing on national security and foreign policy.