OMM Newsroom
AnewZ reports that researchers at blockchain analytics firms TRM Labs and Chainalysis have attributed the theft of $6.3 billion in cryptocurrency from the Binance platform to a cyber operation known as TraderTraitor, which is linked to North Korea. Experts have described the attack as the largest recorded cryptocurrency theft.
Cybersecurity specialists say the theft is the latest phase in a years-long campaign that has reportedly generated billions of dollars for the North Korean government. Western officials say the funds help finance military, nuclear and ballistic missile programs.
According to a report published by Chainalysis late last year, North Korean groups had stolen at least $6.75 billion worth of cryptocurrency by the end of 2025. The figure includes $1.5 billion stolen from the Bybit exchange in February 2025.
Cybersecurity experts say a separate attack on cryptocurrency platform Bitget in September resulted in the theft of $387 million. Michael Barnhart, a researcher at DTEX, said the latest attack on Binance brings the minimum volume of cryptocurrency linked to North Korean theft operations to about $13.5 billion.
Binance said it was working with industry partners and investigative agencies to trace the stolen assets. The company said it had identified about $3 billion worth of cryptocurrency connected to the theft and was working to freeze or recover as much as possible.
“After the Bitget incident, many members of the community expected something like this to happen,” Barnhart said.
Methods used by the hackers
Security researchers say the TraderTraitor group is distinguished by its patience and ability to infiltrate organizations over an extended period. The group was cited in a 2022 joint advisory by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA) and the U.S. Treasury Department.
According to the advisory, hackers use malware, social engineering and deceptive recruitment campaigns to gain access to target organizations. One of their most effective methods is to approach software developers and IT professionals while posing as employers and offering fake job openings.
Victims are persuaded to take part in fictitious interviews and download malicious files. This gives hackers access to credentials and internal systems.
Barnhart called TraderTraitor North Korea’s most capable cyber operation focused on the financial sector. He said the group includes some of the most experienced operators working in the regime’s cyber programs.
Rafe Pilling, chief threat researcher at Sophos, said details emerging about the Binance attack were consistent with methods repeatedly associated with North Korean cyber groups. He said the group was particularly skilled at infiltrating decentralized finance companies and had a strong understanding of the internal financial procedures companies use to approve large transactions.
Possible uses of the stolen cryptocurrency
Cybersecurity experts and government officials say the proceeds from these operations are not limited to financial gain. Barnhart said stolen cryptocurrency is typically transferred to Chinese organized crime networks involved in money laundering and then reaches North Korea.
Western governments say the funds are used to support Pyongyang’s military ambitions. According to a recent FBI advisory, North Korean nationals secretly take jobs at technology and financial companies abroad to generate revenue for the government and collect sensitive information. The FBI has said proceeds from these employment schemes and cyber thefts help finance North Korea’s military activities.
A U.S. State Department spokesperson called North Korea’s cybercrime a global security problem. The spokesperson said the country was increasingly turning to cybercrime to evade international sanctions and fund its illicit weapons of mass destruction and ballistic missile programs. The official added that cryptocurrency theft and money laundering had become key elements of this strategy.
Experts say the issue has consequences beyond the cryptocurrency industry. North Korean leader Kim Jong Un has repeatedly called for advances in military technology, including the capabilities of unmanned aerial vehicles. Barnhart said proceeds from cybercrime directly support these aims.
Barnhart also linked the financing mechanism to North Korea’s military support for Russia. “North Korea has sent troops, ammunition and weapons components to Russia; all of this has been financed through the same system. That is why a cryptocurrency attack is not just a problem for the targeted exchange, but a national security issue,” he said.
As investigators continue to trace the stolen funds, security experts say cryptocurrency companies remain prime targets for sophisticated, state-backed cyber groups seeking access to large volumes of digital assets.
