The F.B.I. said on Saturday that North Korea was responsible for the hacking attack on Binance this week, the first official acknowledgment of the regime’s role in the biggest crypto heist in history.
Poor, isolated and heavily sanctioned, North Korea is not a country you would expect to field an elite army of hackers capable of pulling off billion-dollar heists. But for years, security officials had warned that the regime’s cyberattacks were becoming increasingly sophisticated, looting enormous sums to support North Korea’s military and nuclear-weapons program.
Those fears peaked this week when Binance, the world’s largest cryptocurrency exchange, announced that hackers had made off with some $6 billion. The F.B.I. on Saturday accused the North Korean hacking unit TraderTraitor of carrying out the attack, which crypto research firms said made use of asset laundering patterns that had not been seen before.
The specifics of the attack are still being established. Binance initially said the hackers might have compromised an engineer’s laptop, leading to unauthorized withdrawals. But in an update on Friday, the company said it had identified “additional points of breach.” The F.B.I. said it had observed TraderTraitor actors converting stolen assets into Ethereum.
Powered by a pipeline of top-class programming students, North Korea’s hacking units have for years penetrated banks and companies and capitalized on the rise of crypto. A U.N. panel in 2024 found the regime’s cyberattacks had generated about half its foreign currency income, amounting to billions in revenue. Experts agree that the regime is now one of the biggest and most capable cyber threats in the world.
Here is a look at some of North Korea’s most famous earlier hacks.
2014: The Sony Attack
In 2014, the tech and media giant Sony Pictures was preparing to release “The Interview,” a far-fetched comedy about the assassination of the North’s leader.
Then, American officials said, hackers associated with the Lazarus Group, a shadowy hacking syndicate backed by the North Korean government, breached the company’s computers. (The bureau has said Lazarus and TraderTraitors are both fronts for the same regime-backed hackers).
The attacks caused the leaks of internal documents containing salary information that humiliated top company officials and stole terabytes of data.
North Korea has never formally taken responsibility for the attack. At the time, however, Kim Jong-un, the country’s dictator, called the film an “act of terrorism.”
2016: Custom Malware
In 2016, North Korean hackers tried to steal about $1 billion from the Federal Reserve Bank of New York. Only a spelling error stopped them.
Using a payment messaging system known as SWIFT, the hackers were able to persuade the New York Fed to move money to accounts in the Philippines. The hackers were looting an account of the Bangladesh Central Bank when bankers grew suspicious about a withdrawal request that had misspelled “foundation” as “fandation.”
Still, the hackers made off with $81 million.
The attack was important because it showed how savvy North Korean hackers were becoming. In contrast to off-the-shelf tools that had been used in other attacks at the time, the malware the thieves devised for this heist was a custom code, configured for a specific bank. Written from scratch, it was unfamiliar to existing virus-protection programs.
Crypto Booms and Busts
As the cryptocurrency market boomed in the mid 2010s, North Korea began targeting firms in the industry, escalating to large-scale attacks on crypto exchanges by 2020, according to a North Korea-focused publication of the Stimson Center, a Washington-based think tank.
North Korean hackers were accused of stealing $571 million from crypto exchanges between January 2017 and September 2018 and $316 million from 2019 to November 2020.
With borders shut because of the coronavirus pandemic and traditional banks strengthening their firewalls against hackers, cryptocurrency theft was becoming an increasingly vital source of foreign currency for the regime.
In 2022, the United States publicly accused the Lazarus Group of stealing $620 million in cryptocurrency from the video game Axie Infinity.
That year, North Korea’s haul was a little under $1 billion, according to Chainalysis, a crypto analytics firm, which found 50 percent of the industry’s yearly losses were from North Korean hacks.
Given the history of spectacular market crashes, crypto is hardly a stable source of funding. But at a time when North Korea had locked itself down during the pandemic, hacking crypto exchanges allowed it to generate income in ways that were both Covid-safe and harder to trace in an industry subject to limited government oversight.
2025: The Bybit Attack
In February 2025, North Korean hackers pulled off what was then the biggest heist in the crypto industry’s history, stealing $1.5 billion in cryptocurrencies, according to the F.B.I.
To pull off the breach, the hackers exploited the cryptocurrency exchange ByBit’s reliance on a free software product.
The North Korean hackers had tricked the chief executive of Bybit, Ben Zhou, into authorizing a seemingly routine transaction that handed them control of the exchange’s system.
After looting Bybit, the North Korean hackers spread the stolen funds across a vast web of online crypto wallets, a money-laundering strategy that they had also employed after other heists.
The post North Korean Hackers Stole Billions, the F.B.I. Says. It’s Not Their First Heist. appeared first on New York Times.
