North Korean Hackers Emerge as Crypto Theft Powerhouse After Binance Raid

North Korean hackers suspected of carrying out the record theft from cryptocurrency exchange Binance are being described by security researchers as among the most capable and prolific operators targeting digital assets. The case has also renewed scrutiny of how crypto theft can support Pyongyang’s military programs.

Binance attack puts TraderTraitor in focus

Blockchain firms TRM Labs and Chainalysis have linked the October 29 attack to TraderTraitor, a name used by the U.S. government for North Korea-linked activity against blockchain companies. TRM said about $6.36 billion moved from Binance wallets across 10 blockchains, with most of the transfers occurring within minutes. Binance said it was investigating a security incident and temporarily suspended withdrawals on several networks.

The attribution remains an assessment rather than a judicial finding. Researchers cited similarities with earlier North Korea-linked operations, while TRM said its conclusion was based on on-chain and off-chain intelligence. Binance and other companies were working to freeze some of the assets; Reuters reported that about $3 billion had been located at the time of its report.

A broader record of crypto theft

Chainalysis said North Korea stole at least $2.02 billion in cryptocurrency during 2025, bringing its lower-bound cumulative total through that year to $6.75 billion. That estimate includes the $1.5 billion Bybit theft in February 2025. Researcher Michael Barnhart told Reuters that attacks on Bitget and Binance raised his estimate for the country’s total cryptocurrency thefts to roughly $13.5 billion, though the figure is an expert estimate rather than an independently established total.

TraderTraitor has targeted developers and technology staff through malware, phishing and fake recruitment processes, according to a joint FBI, CISA and Treasury advisory. The advisory says such intrusions can steal private keys or exploit other security weaknesses to initiate fraudulent blockchain transactions.

Why the money matters beyond crypto

U.S. officials have said North Korean cybercrime is increasingly used to evade sanctions and fund weapons-of-mass-destruction and ballistic-missile programs. Reuters also reported that researchers believe stolen funds are passed through money-laundering networks, making the Binance incident a national-security concern as well as an exchange-security crisis.

Sources

• Reuters report — reporting on the Binance theft, expert attribution, estimates and official statements.
• TRM Labs analysis — on-chain estimate, TraderTraitor assessment and attack mechanics.
• Chainalysis Crypto Crime Report analysis — 2025 North Korea-linked theft estimate and laundering patterns.
• FBI-CISA-Treasury TraderTraitor advisory — documented targeting methods and threat background.

Photo illustration: Binance logo on a smartphone with a digital-security graphic in the background. VCG / VCG via Getty Images; via CNBC.