North’s hackers likely behind the record US$6.3bil (RM25.5bil) theft from cryptocurrency exchange Binance are among the world’s most prolific crypto thieves, and the proceeds help fund the country’s weapons programmes, cybersecurity experts said.
Blockchain investigation firms TRM Labs and Chainalysis attribute the heist to a North Korean hacking group known as “TraderTraitor”, a name used in a 2022 joint warning from the FBI, CISA and US Treasury that described how hackers used malicious software and other tricks to target software developers and IT staff at cryptocurrency firms.
North Korea stole at least US$6.75bil in cryptocurrency through the end of 2025, Chainalysis said in a December 2025 report. That total includes the US$1.5bil ByBit exchange hack in February 2025.
The group also hit Bitget, a separate exchange, taking US$387mil (RM1.57bil) in September, experts have said, bringing the minimum total of cryptocurrency North Korea has stolen to roughly US$13.5bil (RM54.7bil), said Michael Barnhart, a researcher with cybersecurity firm DTEX.
Binance said it and others were working to freeze some of the stolen cryptocurrency, with about US$3bil (RM12.1bil) located so far.
“After Bitget, a lot of the community expected something like this,” Barnhart said.
TraderTraitor is North Korea’s “most capable hacking group with a primary focus on financials and one staffed by some of the most experienced operators in the regime’s cyber programs in the former APT38 ranks”, he added, referring to North Korea’s long-running financially focused hacking units.
Researchers say TraderTraitor targets developers and IT staff at financial institutions through malware or phony job offers, tricking candidates into downloading malicious software during fake job interviews, giving the hackers access to login credentials and other sensitive data. — Reuters
