North Korea’s TraderTraitor hackers are blamed for a record US$6 billion Binance crypto theft. US authorities say the group is linked to Lazarus and Pyongyang’s cyber warfare programme.

TraderTraitor uses fake job offers and malware to steal data and digital assets. The FBI says hackers have also hit DMM Bitcoin, Atomic Wallet, Alphapo, CoinsPaid and Bybit.

Stolen crypto is laundered through mixing services and private exchanges, then used for weapons research and procurement. Analysts say cybercrime gives North Korea fast money despite sanctions.

AI generated SEOUL – North Korea’s TraderTraitor hacking group has been blamed by US authorities for stealing more than US$6 billion (S$7.7 billion) in virtual assets from Binance, in what is believed to be the largest crypto heist in history.

The Oct 29 attack is the latest in a string of high-profile cyber thefts linked to Pyongyang, which has built a formidable hacking operation, generating funds believed to help finance its weapons programme. Here are five things to know about the group and its place in North Korea’s cyber warfare programme:

Who are they? TraderTraitor is the name given to a North Korean hacking operation linked to the broader Lazarus Group, which gained notoriety in 2014 when it hacked Sony Pictures in retaliation for The Interview, a satirical film that mocked North Korean leader Kim Jong Un.

Pyongyang has invested heavily in developing its cyber capabilities since at least the mid-1990s, building a formidable force that South Korean intelligence estimated in 2024 comprised around 8,400 personnel. “North Korea has built a capable cyber force, funnelling many of the country’s top students into computer science and IT training,” the FBI said on its website.

Much of the hacking activity is known to have been directed by Pyongyang’s Reconnaissance General Bureau, its primary foreign intelligence agency.

“The top two students in my class were recruited to the hacking unit,” South Korean MP Park Choong-kwon, who studied at the North’s elite National Defense University before his defection, told AFP in a 2024 interview.

How do they operate? TraderTraitor actors have been known to pose as recruiters offering lucrative jobs to trick victims into downloading malicious software.

The malware can allow hackers to infiltrate victims’ computer systems and steal sensitive information and digital assets.

In a 2024 heist involving the theft of US$308 million from Japanese cryptocurrency exchange DMM Bitcoin, a North Korean hacker posing as a recruiter on LinkedIn contacted an employee of a separate virtual currency wallet software company.

They sent the employee what appeared to be a pre-employment test, which actually contained a malicious line of code.

That allowed the hacker to compromise their system and impersonate the employee, the FBI said.

What have North Korean hackers done? High-profile cyberattacks attributed to North Korean hackers include the theft of US$81 million from Bangladesh’s central bank in 2016 and the WannaCry ransomware attack that disrupted computers worldwide in 2017.

In 2022, US authorities blamed Lazarus-linked hackers for stealing around US$620 million from the Ronin blockchain network.

The FBI subsequently attributed three more cryptocurrency heists in 2023 to TraderTraitor actors, involving the theft of nearly US$200 million from Atomic Wallet, Alphapo and CoinsPaid.

The scale of the thefts increased dramatically in February 2025, when the FBI blamed TraderTraitor for stealing around US$1.5 billion in virtual assets from cryptocurrency exchange Bybit.

“TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets,” the FBI said at the time.

How does North Korea use stolen funds?

The North Korean regime launders stolen cryptocurrency and converts it into cash “through mixing services or private exchanges”, Lim Eul-chul, a professor at the Institute for Far Eastern Studies at Kyungnam University, told AFP.

“The proceeds are then channelled directly into military research, the illicit procurement of weapons components and the defence industry,” he added.

A 2024 United Nations report said proceeds from North Korean cyberattacks “reportedly helped to fund the country’s development of weapons of mass destruction”. Why cybercrime?

Analysts say Pyongyang’s illicit cyber activity is driven by its ability to obtain vast sums of money quickly and at “minimal cost”.

“While international sanctions severely restrict North Korea’s ability to earn foreign currency through conventional trade, cyber theft allows it to acquire billions of dollars with minimal personnel and resources,” said Lim of Kyungnam University.

“Hacking offers Pyongyang a way to obtain funds outside conventional banking channels, taking advantage of the pseudonymous and borderless nature of digital assets to bypass financial restrictions,” he added.