North Korea's Crypto Hacking Machine Funds Its Nuclear Arsenal

A single theft of $6.3bn (£4.7bn) from Binance — attributed by blockchain forensics firm TRM Labs to TraderTraitor, the elite North Korean hacking unit also known as the Lazarus Group — has put a number on how Pyongyang bankrolls itself while cut off from the global economy. The link isn't proven yet, but the pattern is one investigators know by heart.

North Korea has run crypto theft operations since 2017, targeting an industry whose security controls still lag far behind traditional finance. The proceeds feed its military, including the nuclear weapons programme run by Kim Jong-un, who controls an estimated stockpile of about 50 nuclear warheads and has supplied troops and weapons to Russia's war in Ukraine.

How much of North Korea's money is stolen crypto?

More than practitioners probably assume. A UN panel of experts reporting to the Security Council said in spring 2024 that it was reviewing "58 suspected cyber-attacks" by North Korea "on cryptocurrency-related companies between 2017 and 2023," worth a combined $3bn.

The panel estimated that cash generates half of North Korea's foreign currency income. One unnamed country went further, telling the panel the stolen billions fund "40% of the weapons of mass destruction programmes." That's the so-what for compliance teams: crypto security isn't just a balance-sheet issue, it's a sanctions and proliferation issue.

The pace is accelerating. In 2023 alone, researchers counted as many as 17 suspected North Korean crypto thefts valued at $750m. The previous record hack came in February 2025, when $1.5bn was taken from the Bybit exchange — the FBI attributed it to TraderTraitor.

Why crypto and not banks?

Ciaran Martin, former head of the UK's National Cyber Security Centre, says the targeting logic is straightforward: banks hardened their defences, and crypto didn't. "Over the last decade, hackers have walked off with nine- or 10-figure sums from crypto hacks on more than 30 occasions. The number of traditional banks who have suffered a loss of more than $100m as a result of a cyber-attack in the same period is zero or one," Martin said.

North Korea pulled off one of the last big bank heists itself. In February 2016, its hackers tried to move $951m illicitly from a Bangladesh Bank account at the Federal Reserve Bank of New York, exploiting time differences between the two. Pure luck stopped most of it: the intermediary Philippine bank sat on Jupiter Street, and "Jupiter" matched the name of a sanctioned Iranian ship, so most transfers were held up. The thieves still got away with $81m.

Crypto isn't Pyongyang's only sideline. The state was accused of forging high-quality $100 "supernotes" in the 1990s and producing and trafficking crystal meth for export in the 2000s. Criminal enterprise, in other words, is a longstanding revenue line, not a new one.

What does this change for exchanges and banks?

Britain offers a case study in quiet defence. In 2019, North Korean hackers tried to seize control of cash machines linked to 56 financial institutions to make them pay out sums well beyond normal limits. British officials spotted it, alerted the banks, and the attack was suppressed with no media coverage. Detection worked — but it required state intelligence tipping off the private sector.

The talent pipeline is state-run. Ordinary North Koreans are denied internet access, but maths and science are pushed hard at school, and top university students are recruited into groups like Lazarus, operating under the Reconnaissance General Bureau, the country's spy agency. The 2014 Sony Pictures hack — retaliation for the studio funding The Interview, a Seth Rogen comedy depicting Kim Jong-un's assassination — showed the group will strike non-financial targets for political ends too. Sony tried to cancel the film, then reversed course after criticism for caving in to pressure.

With theft volumes climbing from $81m in 2016 to $6.3bn in a single alleged Binance incident, the burden is shifting to exchanges and custodians: match banking-grade defences, or become the funding source for a nuclear programme.