How hacking became a key weapon for sanctions-hit North Korea

A $6.3 billion hole opens in the world's largest exchange

On 29 October 2026, hackers drained more than $6 billion in digital assets from Binance, the world's largest exchange, in the largest cryptocurrency theft on record. Binance put the loss at $6.34 billion. TRM Labs estimated about $6.36 billion taken across ten blockchains, most of it in roughly twenty minutes; Elliptic put the total at about $6.43 billion.

On 31 October, the Federal Bureau of Investigation said the Democratic People's Republic of Korea was responsible, naming the operation TraderTraitor. With the Secret Service and the Internal Revenue Service's criminal investigation arm, the bureau said the group was converting the proceeds mainly into Ethereum and urged exchanges and blockchain firms to block transactions linked to 628 published addresses.

Binance said it had replaced about 90 per cent of the stolen assets by 31 October, at no loss to customers. On 3 November, Kim Yo Jong, the sister of leader Kim Jong Un, dismissed the accusation through the state news agency KCNA as "absurd rhetoric" and a "trite provocation". A week later, Elliptic reported the laundering was under way, routed through newly created tokens designed to look like ordinary trading.

A months-long intrusion that ended in twenty minutes

Binance's account, published on 3 November, describes a sophisticated, multi-stage campaign. The attackers spent months working their way in: a fake recruitment interview induced a Binance engineer to download malicious code, and a tampered development tool was planted in June on a wallet developer's machine. Co-chief executive Richard Teng said the breach involved a compromised laptop and software designed to delete evidence.

It is the same operation the FBI blames for the $1.5 billion Bybit theft in February 2025, then the largest crypto heist on record. A joint American advisory in 2022 had already named TraderTraitor as a North Korean operation linked to the Lazarus group, and an FBI notice in September 2024 warned of North Korean social-engineering campaigns against crypto firms, including fake job offers.

The laundering trail is unusually well mapped. Elliptic reported on 9 November that operators linked to North Korea created six throwaway tokens on the NEAR blockchain between 5 and 7 November, FUK, OLCCL, MEILI, MMLI, DABI and SINU, and moved about $430,000 through their liquidity pools, disguised as ordinary trading. Its wider tracker counts 20,000-plus wallets, 16 blockchains, 36 services and 65,000 transactions. About $2.85 billion, or 44 per cent, had been frozen or seized by 9 November, while about $3 billion remained in linked addresses. One name from the older cases has returned: Park Jin Hyok, the North Korean programmer on the FBI's wanted list for eight years.

What the attribution does not prove about where the money lands

The FBI's attribution is a statement by investigators, not a court finding, and Pyongyang denies it outright. No public evidence has shown the money's final destination: analysts say the thefts could be helping to fund the weapons programmes, but no published report traces specific stolen funds to specific purchases.

Binance has not published a root-cause finding, and the route from the compromised laptop to the wallet-signing infrastructure remains undisclosed. How much has actually been converted into spendable cash is also unclear: the frozen share is counted, the share in flagged addresses is counted, and the gap is what the launderers are working through now.

Two enforcement questions are open. The FBI asked THORChain operators and other services to refuse the listed transactions, but THORChain has not committed to act. And none of the 628 addresses appears on the United States Treasury's sanctions list, according to American Banker; TraderTraitor is not specifically designated, so blocking is voluntary for now.

A heist worth a sixth of a country's income

The scale turns a crime story geopolitical. Lee Ho-ryung of the Korea Institute for Defense Analyses estimates the $6.3 billion stolen is equivalent to roughly one-sixth of North Korea's annual national income; and about fifteen times the $420 million to $430 million it earned from exports last year.

The pattern is accelerating. Elliptic estimates North Korea has stolen $7.6 billion in cryptocurrency this year, more than in any previous year, and an October 2025 report found Pyongyang laundering stolen crypto into cash through brokers in China, Russia and Cambodia. State-run hacking is not a North Korean monopoly: France has accused Iran's Shahid Kaveh unit of hacking supermarket fridges.

The damage runs the other way too: Binance customers withdrew a net $4.72 billion by 2 November. South Korea's foreign ministry calls the cyber activity not only a funding source for the nuclear and missile programmes but a threat to the global digital economy; a warning to every exchange, bank and regulator holding other people's money online.

Sanctions built the incentive; crypto built the road

The heist is the meeting point of two systems: sanctions closed North Korea's licit economy, exports of $420 million against a theft of $6.3 billion, and cryptocurrency offered a channel needing no bank, no port and no correspondent account. A state with no access to the formal financial system industrialised the informal one instead, and the skills it built over years are the same ones the formal economy rewards.

The operation shows the professionalisation: months of quiet access, a tampered tool, a twenty-minute drain, then chain-hopping and disposable tokens that break the visible link between thief wallets and payout wallets. Each step answers the last round of defences: blocklists fail when the only connection is a liquidity pool, so Elliptic traces what funded each pool rather than whom the wallets belong to. Washington is fighting the same supply-chain battle on hardware, as the Nvidia spy scandal and the chip-export debate showed the same week.

The United States can name the group, publish 628 addresses and warn the industry, but it cannot arrest anyone believed to be inside North Korea, cannot compel a decentralised service to comply, and has not sanctioned the group. Enforcement stops at the edge of the network.

The heist that rewrites the security budget of every exchange

Every large exchange will now face the question Binance is answering: how a tampered tool and a fake job interview reached wallet-signing infrastructure, and what its third-party review finds. Developer-tool supply chains, insider-threat screening and proof of reserves have moved from compliance footnotes to the first page of the security budget, and the $4.72 billion in net withdrawals shows confidence, not code, is the balance sheet that matters.

Regulators face a choice between designations and diplomacy. Designating TraderTraitor would turn the FBI's voluntary list into a legal obligation; refusing leaves the blocking effort to the goodwill of node operators. Either way, the October 2025 report's broker routes, China, Russia, Cambodia, return in the next cycle. The pressure system has more than one front: Iran has held to the nuclear treaty even as hardliners raise the prospect of a bomb, a reminder that sanctions are tested on several fronts at once.

What to watch in the trace, the freeze and the designation

Three numbers move first: the frozen share, about $2.85 billion; the share still in theft-linked addresses, about $3 billion; and the count of wallets, services and transactions in Elliptic's tracker. Watch whether the Treasury designates TraderTraitor or any of the 628 addresses, whether THORChain's operators answer the FBI's request, and what Binance's third-party review concludes.

In Seoul, watch for the new cyber defence body President Lee Jae Myung called for, and the working groups with the United States and Japan. The next multinational monitoring report will show whether the broker routes through China, Russia and Cambodia have shifted; and whether the year's record $7.6 billion in stolen cryptocurrency grows again before the year ends.