Poor, isolated and heavily sanctioned, North Korea is not a country you would expect to field an elite army of hackers capable of pulling off billion-dollar heists.
But for years, security officials had warned that the regime’s cyberattacks were becoming increasingly sophisticated, looting enormous sums to support North Korea’s military and nuclear weapons program.
Those fears peaked this week when Binance, the world’s largest cryptocurrency exchange, said that hackers had made off with some $6 billion in what could be the biggest crypto heist in history. Crypto research firms quickly attributed the attack to North Korea, saying it bore the hallmarks of the country’s previous hacks — although officials have not confirmed the North’s role.
Powered by a pipeline of top-class programming students, North Korea’s hacking units have penetrated banks and companies and capitalized on the rise of crypto. A U.N. panel in 2024 found the regime’s cyberattacks had generated about half its foreign currency income, amounting to billions in revenue. Experts agree that the regime is now one of the biggest and most capable cyber threats in the world.
As investigators dig into the Binance attack, here is a look at some of the most famous North Korean hacks.
2014: The Sony Attack
In 2014, the tech and media giant Sony Pictures was preparing to release “The Interview,” a far-fetched comedy about the assassination of the North’s leader.
Then, American officials said, hackers associated with the Lazarus Group, a shadowy hacking syndicate backed by the North Korean government, breached the company’s computers.
The attacks caused the leaks of internal documents containing salary information that humiliated top company officials and stole terabytes of data.
North Korea has never formally taken responsibility for the attack. At the time, however, Kim Jong-un, the country’s dictator, called the film an “act of terrorism.”
2016: Custom Malware
In 2016, North Korean hackers tried to steal about $1 billion from the Federal Reserve Bank of New York. Only a spelling error stopped them.
Using a payment messaging system known as SWIFT, the hackers were able to persuade the New York Fed to move money to accounts in the Philippines. The hackers were looting an account of the Bangladesh Central Bank when bankers grew suspicious about a withdrawal request that had misspelled “foundation” as “fandation.”
Still, the hackers made off with $81 million from the central bank of Bangladesh.
The attack was important because it showed how savvy North Korean hackers were becoming. In contrast to off-the-shelf tools that had been used in other attacks at the time, the malware the thieves devised for this heist was a custom code, configured for a specific bank. Written from scratch, it was unfamiliar to existing virus-protection programs.
Crypto Booms and Busts
As the cryptocurrency market boomed in the mid 2010s, North Korea began targeting firms in the industry, escalating to large-scale attacks on crypto exchanges by 2020, according to a North Korea-focused publication of the Stimson Center, a Washington-based think tank.
North Korean hackers were accused of stealing $571 million from crypto exchanges between January 2017 and September 2018 and $316 million from 2019 to November 2020.
With borders shut because of the coronavirus pandemic and traditional banks strengthening their firewalls against hackers, cryptocurrency theft was becoming an increasingly vital source of foreign currency for the regime.
In 2022, the United States publicly accused the Lazarus Group of stealing $620 million in cryptocurrency from the video game Axie Infinity.
That year, North Korea’s haul was a little under $1 billion, according to Chainalysis, a crypto analytics firm, which found 50 percent of the industry’s yearly losses were from North Korean hacks.
Given the history of spectacular market crashes, crypto is hardly a stable source of funding. But at a time when North Korea had locked itself down during the pandemic, hacking crypto exchanges allowed it to generate income in ways that were both Covid-safe and harder to trace in an industry subject to limited government oversight.
2025: The Bybit Attack
In February 2025, North Korean hackers pulled off what was then the biggest heist in the crypto industry’s history, stealing $1.5 billion in cryptocurrencies, according to the F.B.I.
To pull off the breach, the hackers exploited the cryptocurrency exchange ByBit’s reliance on a free software product.
The North Korean hackers had tricked the chief executive of Bybit, Ben Zhou, into authorizing a seemingly routine transaction that handed them control of the exchange’s system.
After looting Bybit, the North Korean hackers spread the stolen funds across a vast web of online crypto wallets, a money-laundering strategy that they had also employed after other heists.
2026: The Binance Hack
This week, that record was broken in the Binance hack. Hackers stole $6.3 billion in an attack that used “laundering patterns we have not seen before,” Chainalysis wrote in a blog post on Friday.
Binance initially said that the hackers might have compromised an engineer’s laptop, leading to unauthorized withdrawals. But in an update on social media on Friday, the company said it had identified “additional points of breach.”
The specifics of the attack are still being established. TRM Labs, a crypto research firm, said it appeared to be the work of TraderTraitor, which the F.B.I. says is another name for the Lazarus Group.
But U.S. officials have not yet publicly attributed the hack to North Korea.
The post North Korean Hackers May Have Stolen Billions. It Wouldn’t Be Their First Heist. appeared first on New York Times.
