North Korea plays by its own rules. The isolated, secretive and autocratic country is largely cut off from the world’s economic system – but when it comes to generating foreign earnings it relies on some of the world’s most sophisticated hacking.
Experts, such as TRM Labs, quickly attributed the extraordinary $۶.۳bn (£۴.۷bn) Binance cryptocurrency theft to TraderTraitor, an elite North Korean hacking unit that has also been known as the Lazarus Group. Though the link may not be proven yet, the pattern of behaviour is familiar.
North Korea has a history of cryptocurrency theft dating back to ۲۰۱۷, focusing on the sector’s relatively lax security controls as a way of stealing money and generating revenues for its military, including its nuclear weapons programme.
Kim Jong-un, its dictatorial ruler, controls a stockpile of about ۵۰ nuclear warheads, and has been supplying troops and weapons to help Russia in its war in Ukraine. But North Korea is also extremely poor: ۴۰% of the population are undernourished according to the UN and nearly one in five of its children are stunted.
A UN panel of experts, reporting to the security council, said in the spring of ۲۰۲۴ that it was reviewing “۵۸ suspected cyber-attacks” by North Korea “on cryptocurrency-related companies between ۲۰۱۷ and ۲۰۲۳” worth $۳bn.
The panel said the cash was estimated to generate half of North Korea’s foreign currency income. One unnamed country went further with its estimate: the stolen billions fund “۴۰% of the weapons of mass destruction programmes”.
The suspected crypto hacks amounted to as many as ۱۷ in ۲۰۲۳ alone: thefts valued at $۷۵۰m, and disturbingly, the sums involved are only increasing. The world’s largest previous crypto hack took place in February ۲۰۲۵, when $۱.۵bn was stolen from the Bybit exchange – the work, the FBI said, of TraderTraitor.
Ciaran Martin, a former head of the UK’s National Cyber Security Centre, argues that North Korea appears to have targeted crypto because traditional banks have developed sophisticated defences that the fast-growing and lightly regulated sector has yet to match.
“Over the last decade, hackers have walked off with nine- or ۱۰-figure sums from crypto hacks on more than ۳۰ occasions. The number of traditional banks who have suffered a loss of more than $۱۰۰m as a result of a cyber-attack in the same period is zero or one,” Martin said.
North Korea was behind one of the last large cyber thefts on a traditional bank – an attack on Bangladesh Bank in February ۲۰۱۶, where North Korean hackers tried to illicitly move $۹۵۱m from an account the bank had with the Federal Reserve Bank of New York, taking advantage of time differences between the two.
A piece of luck prevented most of the money from being sent to an intermediate account in the Philippines. The corresponding bank was based on Jupiter Street, which shares its first word with the name of a sanctioned Iranian ship, so most of the transfers were held up. In the end, $۸۱m was stolen.
The isolated state has long been accused of engaging in criminal activities to survive, including the forgery of high-quality $۱۰۰ bills, known as “supernotes” in the ۱۹۹۰s, and the production and trafficking of crystal meth for export in the ۲۰۰۰s.
The UK has been rarely targeted. In ۲۰۱۹, North Korean hackers did try to take control of cash machines linked to ۵۶ financial institutions to make them pay out sums well in excess of normal. British officials spotted what was afoot, alerted the banks and the hack was quietly suppressed with no media coverage.
The irony is that the internet in North Korea is severely restricted, with access denied to the general population. Maths and science are pushed at school, however, and at university some of the best students are recruited into hacker groups, such as Lazarus, operating under the auspices of the country’s Reconnaissance General Bureau spy agency.
Hacking is closely tied to the all-powerful state. In December ۲۰۱۴, it emerged, to the embarrassment of Sony Pictures, that film stars Jennifer Lawrence and Amy Adams were paid less than their male counterparts in American Hustle. It was one of thousands of embarrassing emails leaked from the Hollywood studio through a hack.
The attack, by North Korea’s Lazarus Group, was conducted because Sony had funded a film, The Interview: a Seth Rogen comedy that depicted the assassination of Kim Jong-un. Amid the chaos of the revelations, Sony tried to cancel the movie, then had to U-turn on its retreat, releasing it online and to a handful of cinemas, after being criticised for caving in to North Korean pressure.
