It is one of the most isolated and hermetic countries on the planet. Its foreign trade is limited to a few related countries, it has been subject to embargoes for years, and almost no one knows what actually happens beyond its borders. Yet North Korea has emerged as a true superpower in cybercrime.
Although it has yet to be officially confirmed, some hints and coincidences suggest that Pyongyang may be behind the cyber security incident that saw around $6.36 billion disappear from the Binance wallet this morning. It is not the first attack of this style to be attributed to a group of highly specialized cybercriminals acting at the behest of North Korea.
Binance, stealing a record with a known signature. The total impact of the hit on Binance is estimated to be close to $6.3 billion, and could have been more had half of that not been frozen. Tether blocks about 1.6 billion and Circle over 800 million in USDC. This number is four times higher than the previous record for cryptocurrency theft: Bybit 2025, where around $1.5 billion in cryptocurrency disappeared.
Cybersecurity firm TRM Labs has “high confidence” that the theft is linked to TraderTreater, a group linked to the Lazarus cybercriminal network. According to TRM LAbs, “Several features of this attack are consistent with previous thefts linked to North Korea.” Other researchers point in the same direction. Caution is advised as the attribution is still preliminary and the FBI has not officially commented on the matter.
Bybit and a regime that charges in crypto. However, the most recent example is Bybit. In February 2025, $1.5 billion in Ether disappeared, and the FBI blamed North Korea days later. Thieves distribute a portion of the loot to thousands of addresses on different blockchains to launder it. Researchers linked the Bybit attack to Binance because some of the addresses used in this latest attack were also used in the 2025 attack.
Chainalysis estimates that regime-linked hackers stole about $2.02 billion in cryptocurrency in 2025, up 51% from the previous year and the highest on record. The historic total reached $6.75 billion. Washington has already accused three military programmers of stealing 1.3 billion in 2021.
Post-quantum encryption to hide your tracks. Kaspersky documented Operation Flashhole in an investigation, which has been active since at least July 2025 and targeted software, construction and telecommunications companies in South Korea. The attackers used a fake resume and possibly an AI-generated photo. A fairly simple technique that acts as a decoy for a phishing attack However, what’s new is a Lazarus tool that protects new program downloads with ML-KEM-1024, a post-quantum algorithm.
Kaspersky researcher Sojun Ryu said the country The technology is considered “the cryptography of the future, designed to be secure against quantum computers.” ML-KEM is one of three standards finalized by NIST in August 2024 No known quantum computer has yet broken current encryption, so Lazarus hedges against future risks For Ryu, this reveals that Pyongyang’s paid cybercriminals have a highly advanced level of knowledge and specialization and use the most advanced technology to “keep their malicious payloads from being exposed to defenders or investigators.”
Money has a destination. US Director of National Intelligence Tulsi Gabbard has told Congress that these thefts help finance Kim Jong-un’s regime and its strategic weapons program. A 2024 UN report estimated that cryptocurrency theft could contribute up to half of the country’s foreign exchange earnings.
However, North Korea has another prudent source of foreign exchange earnings: teleworking. North Korean computer scientists get remote jobs with stolen identities and use company laptops housed in associates’ homes in the United States, so-called “laptop farms.” The Justice Department detailed a scheme that affected more than 70 companies and generated nearly $3 million. In Texas, the FBI searched more than 40 homes and seized about 187 devices.
In Xataka | Years pass and the FBI exposes the North Koreans themselves and breaks up remote employment networks within the United States.
Picture | Flickr (Previous)
