North Korea’s expanding cyber operations have drawn renewed attention after a reported $6.3 billion cryptocurrency theft from Binance, highlighting how state-linked hackers are targeting global financial institutions to generate revenue for the regime.
The October 29, 2026 attack was attributed by the FBI to TraderTraitor, a North Korean operation linked to the Lazarus Group. Investigators said hackers used malicious software and compromised employee access to reach systems that authorised financial transactions. The stolen amount was reportedly equivalent to nearly 20% of North Korea’s estimated $34 billion annual national income.
A network of trained cyber operators
North Korea’s cyber operations are linked to its military intelligence organisation, the Reconnaissance General Bureau (RGB), and specialist units historically associated with Bureau 121. Known hacking groups include Lazarus, APT38, BlueNoroff, Andariel and TraderTraitor. South Korean estimates suggested around 8,400 personnel were involved in the country’s wider cyber organisation in 2024.
The hackers reportedly use fake recruitment offers, fraudulent business communications and malware to obtain employee credentials. Similar methods were used in the 2024 theft of $308 million from Japan’s DMM Bitcoin. Other major incidents include the 2016 theft of $81 million from Bangladesh Bank, the 2017 WannaCry attack, the 2022 Ronin network theft of $620 million, the $100 million Harmony breach and the 2025 Bybit theft of $1.5 billion.
Funding the regime and attracting global scrutiny
US intelligence estimated that North Korean hackers probably stole $2 billion in cryptocurrency during 2025. Agencies believe some proceeds help finance the country’s nuclear and ballistic missile programmes, although the exact amount reaching these programmes remains unknown.
British intelligence has warned that North Korean operators target cryptocurrency firms, defence industries, governments and universities. The FBI has also urged financial institutions to block transfers linked to identified digital wallets.
North Korea has rejected the allegations. Kim Yo Jong called the Binance accusation “a grave political provocation” and dismissed it as “absurd rhetoric and nothing new”. The FBI has maintained its attribution.
Security specialists recommend stricter employee access controls, independent verification of large transactions, careful screening of remote workers and faster international cooperation to freeze stolen assets.
Also read: Viksit Workforce for a Viksit Bharat
Do Follow: The Mainstream LinkedIn | The Mainstream Facebook | The Mainstream Youtube | The Mainstream Twitter
About us:
The Mainstream is a premier platform delivering the latest updates and informed perspectives across the technology business and cyber landscape. Built on research-driven, thought leadership and original intellectual property, The Mainstream also curates summits & conferences that convene decision makers to explore how technology reshapes industries and leadership. With a growing presence in India and globally across the Middle East, Africa, ASEAN, the USA, the UK and Australia, The Mainstream carries a vision to bring the latest happenings and insights to 8.2 billion people and to place technology at the centre of conversation for leaders navigating the future.