SEOUL, October 31 (AJP) - North Korea's cryptocurrency hacking operations have emerged as a major source of foreign currency for the isolated regime, with a record $6.3 billion cyberattack on the world's largest cryptocurrency exchange drawing renewed attention to Pyongyang's growing reliance on digital theft to finance its weapons programs.
U.S. blockchain intelligence firm TRM Labs said North Korea's TraderTraitor hacking group was responsible for stealing approximately $6.36 billion in digital assets from Binance on Oct. 29, making it the largest cryptocurrency theft on record.
The company said the attackers transferred funds across 10 blockchain networks, with most of the assets stolen within about 20 minutes. TRM Labs expressed high confidence in its attribution, citing blockchain transaction patterns and similarities with previous North Korean operations.
Binance confirmed that its systems had been compromised and said approximately $3 billion in stolen assets had been frozen through cooperation with blockchain companies and law enforcement agencies.
The exchange said it would cover the losses using its emergency protection fund and corporate reserves. It also temporarily suspended withdrawals while investigating the breach and strengthening its security systems.
The incident has intensified scrutiny of North Korea's cyber operations, which international investigators say have become an important means of circumventing economic sanctions and generating revenue for the government of leader Kim Jong-un.
According to blockchain analysis firm Chainalysis, North Korean hackers stole an estimated $2.02 billion in cryptocurrency in 2025, accounting for roughly 60 percent of the approximately $3.4 billion stolen worldwide that year.
The amount represented a 51 percent increase from 2024, bringing the cumulative value of cryptocurrency stolen by North Korean hackers to at least $6.75 billion through the end of 2025.
The financial significance of these operations extends beyond individual cryptocurrency exchanges.
A 2024 report by a United Nations Security Council panel of experts cited information from one member state estimating that malicious cyberactivities generated approximately half of North Korea's foreign currency income.
The report also cited another member state's assessment that illicit cyber operations financed about 40 percent of the country's weapons of mass destruction programs.
UN investigators identified 58 suspected North Korean cyberattacks targeting cryptocurrency-related companies between 2017 and 2023, involving approximately $3 billion in stolen assets.
North Korea has been linked to several major cryptocurrency thefts in recent years. In February 2025, the U.S. Federal Bureau of Investigation attributed the theft of approximately $1.5 billion from cryptocurrency exchange Bybit to TraderTraitor, the same group implicated in the latest Binance attack.
The country's cyber capabilities are supported by a specialized training system designed to identify and develop technically skilled personnel from an early age.
A report published this year by the Washington-based Committee for Human Rights in North Korea said the regime recruits students with strong computer skills and trains them at specialized institutions, including Moranbong College in Pyongyang.
According to the report, Moranbong College selects approximately 30 students annually for a five-year curriculum combining military studies, computer programming, communications interception, codebreaking and hacking.
Graduates are subsequently assigned to the Reconnaissance General Bureau, North Korea's military intelligence organization, or other units involved in intelligence collection and cyber operations.
Pyongyang has also sought to generate revenue by placing information technology workers at foreign companies under false identities.
On Oct. 13, the U.S. Department of Justice announced coordinated enforcement actions targeting North Korean remote IT worker schemes that had affected more than 70 American companies and allegedly generated approximately $3 million in revenue.
U.S. authorities said the operations involved workers using stolen or fabricated identities to obtain remote employment, with assistance from individuals operating computer networks inside the United States.
Copyright ⓒ Aju Press All rights reserved.
