In late October, Binance, the world's largest cryptocurrency exchange, suffered a devastating heist: approximately US$6.36 billion in digital assets vanished within 20 minutes. It was the largest such theft in history. While the official attribution is pending, the FBI and blockchain analytics firm TRM Labs have pointed to North Korea's TraderTraitor hacking unit as the likely culprit. Chainalysis and Elliptic, two other leading firms, concur.
This is not an isolated incident. North Korea has been linked to a string of major crypto thefts, including the 2019 Upbit hack (US$42 million) and the 2025 Bybit breach (US$1.5 billion). Pyongyang consistently denies involvement, but the pattern is unmistakable.
From cyber vandals to financial predators
North Korea's cyber capabilities are the product of decades of deliberate investment. In the 1980s, the state built computing infrastructure, specialized schools, and research centers. The Korea Computer Center, established in 1990, oversaw national IT development. In 1995, Kim Jong-il ordered the military to develop cyber warfare as a strategic defense component. By 1998, computer education became compulsory from the fourth year of middle school.
Early operations, starting in the 2000s, targeted South Korea with disruptive attacks like DarkSeoul (2013), which crippled 32,000 computers at broadcasters and banks, and the 2014 breach of Korea Hydro & Nuclear Power, which leaked blueprints and employee data. The 2017 WannaCry ransomware attack, which affected over 300,000 computers in 150 countries, marked a global escalation.
Today, North Korea's cyber strategy has shifted from disruption to revenue generation. The UN estimated in 2024 that cyber theft accounts for half of North Korea's foreign currency income, with one panel member suggesting it funds 40% of its weapons of mass destruction programs. This shift is a direct response to international sanctions that have strangled the economy.
The training pipeline is rigorous. Students are selected from elite schools like Kumsong Middle School in Pyongyang, then advance to Mirim College, Moranbong College, Kim Il Sung University, or Kim Chaek University of Technology, where they combine military studies with advanced hacking skills. As of 2024, an estimated 8,400 state-sponsored cyber personnel had been trained.
Despite global efforts—financial sanctions, intelligence sharing, and blockchain tracing—attacks persist. The fundamental challenge is jurisdictional: investigations cannot cross borders without consent, and digital evidence is easily destroyed. As tensions on the Korean Peninsula rise, the threat of cyber theft remains a potent tool for Pyongyang, one that is unlikely to be fully neutralized.
