TOKYO -- The recent $6.34 billion Binance cryptocurrency heist began months before the assets were moved.

The FBI last week said the TraderTraitor group, which it identifies as North Korean, was responsible for ft -- believed to be the world's biggest-ever crypto raid Experts who study the hackers say North Korea has developed cyber operations that can spend months building access inside foreign companies before moving quickly to steal digital assets.

Kim Yo Jong, the sister of North Korean leader Kim Jong Un, denied her country's involvement, saying on Wednesday that the allegation was "an extension of Washington's invariable hostile policy toward the DPRK." In its initial incident report, Binance said an engineer downloaded tampered software in June. The company detected the anomaly, replaced the device and changed credentials, but said the attacker had learned the engineer's role and the identities of colleagues on the wallet team.

In September, a second engineer downloaded malicious code disguised as a coding assignment after being approached by a fake recruiter on a job platform. Binance said the attackers used the compromised computer and an internal AI tool in October to access wallet developers' systems. On Oct. 29, stolen credentials helped launch a script that moved assets, including 233 million XRP, a major cryptocurrency, in four minutes. Unauthorized transfers continued for nearly four hours.

The Binance breach shows how cyber theft has become a major source of revenue for Pyongyang, a cash-strapped state constrained by international sanctions. North Korean hackers stole about $2 billion in 2025 -- nearly 60% of the global total, according to Chainalysis. The attack also underscores the challenge for companies as months of quiet infiltration can culminate in a rapid drain of digital assets.

"North Korean hacks are not crimes of opportunity but planned over months and executed with precision once they begin to target, drain and launder stolen crypto credits as soon as possible," said Martyn Williams, a North Korea specialist at the Stimson Center.

Although ordinary North Koreans have no access to the global internet, the government identifies students with technical aptitude and trains them, Williams added. The resulting teams have different assignments: Some focus on cryptocurrency theft, while others steal intellectual property or gather intelligence on government employees, academics and journalists.

The Multilateral Sanctions Monitoring Team, an 11-nation international mechanism that monitors and reports on North Korean violations and evasions of sanctions, described in a 2025 report how Pyongyang's state entities use cyber operations for cryptocurrency heists, espionage and the theft of sensitive information from companies, including defense contractors.

The size of North Korea's crypto army is unclear. In 2024, South Korea's Cyber Operations Command put it at about 8,400 personnel, while Japan's 2025 Defense White Paper cites an estimate of about 6,800.

Yeji Kim, a North Korea adviser at Global Rights Compliance (GRC), called cyber operations "central" to the country's efforts to earn foreign currency. Kim Jong Un has described cyber warfare as an "almighty sword" alongside nuclear weapons and missiles, she said. "Today, it may be the sword that pays for the other two." In a 2024 U.N. Panel of Experts report, one member state estimated that malicious cyber activity generates about half of North Korea's foreign currency income and is used to fund its weapons programs. Another reported that 40% of the funding for the country's weapons of mass destruction programs comes from illicit cyber methods.

"To make the same money from labor, Pyongyang for more than eight years would have to send about 100,000 workers abroad, roughly its entire overseas workforce, and take a $600 monthly quota from each of them," Yeji Kim said. "Twenty minutes against more than eight years: That is the maths behind Pyongyang's bet on cyber." The "line is blurring" between hackers and North Koreans working overseas in IT, Kim added. "One bad hire can compromise the whole company," she said.

The 2025 sanctions-monitoring report says North Korean cyber and IT workers are increasingly sharing techniques, but Williams cautioned that crypto theft is usually carried out by separate teams from those taking overseas IT jobs.

"Sometimes the latter does legitimate work just to be paid while other times it can create backdoors in software that can later be used to infiltrate companies," Williams said. "It's becoming very difficult for companies to verify the identity of remote workers and extra caution is needed." A joint FBI and Japan National Police Agency statement on the theft of cryptocurrency worth $308 million from the Japan-based cryptocurrency company DMM by North Korean cyber actors in May 2024 shows how a patient approach can work.

In that case, an actor posing as a LinkedIn recruiter sent a malicious coding test to an employee at wallet-software company Ginco, whose access was later used to manipulate a DMM transaction.

Kim at GRC said the challenge is the imbalance between a state operation and the companies facing it. "For North Korea this is a 24/7 state operation," she said. For the people on the other side, "it is a job."