Photo via The Hindu

North Korean hackers linked to crypto thefts among world's best, experts say

Read the original at The Hindu ↗
Cite

Reuters. (2026, October 31). North Korean hackers linked to crypto thefts among world's best, experts say. The Hindu. https://www.thehindu.com/sci-tech/technology/north-korean-hackers-linked-to-crypto-thefts-among-worlds-best-experts-say/article71648161.ece

Dated from the outlet's own feed. Check the original for its byline.

The Hindu · collected 2026-10-31 · by Reuters

Quick Summary

Cybersecurity experts suggest that North Korean hackers, likely responsible for stealing $6.3 billion from Binance, are among the most active crypto thieves globally. These thefts help finance North Korea’s weapons programs; since 2025, the country has stolen at least $13.5 billion in cryptocurrency through various hacks on exchanges like ByBit and Bitget. The hackers use sophisticated tactics such as malware and fake job offers to target developers and IT staff, gaining access to sensitive data needed for financial transactions.
Written by AI on 2026-10-31, from this article's own text only (the story summary below draws on all the coverage).

AI analysis

Story summary

On October 29, Binance, the world’s largest cryptocurrency exchange, faced a potential security breach leading to the theft of digital funds worth up to $6.3 billion. The incident prompted stablecoin issuers like Tether and Circle to freeze over $1.5 billion in assets each as a precautionary measure. Binance’s founder, CZ Zhao, acknowledged that it "does look like a hack on Binance," though the company assured users their funds were safe and would be covered if losses occurred. The FBI and cybersecurity firms such as Chainalysis suspect North Korea's Lazarus Group to be behind the attack, which is part of a series of large-scale thefts by the group over recent years. This hack surpasses previous records, including a 2025 incident where approximately $1.5 billion was stolen from ByBit.

Written for “Binance Crypto Hack Investigation” on 2026-10-31, grounded in this article and the 39 other(s) covering the same event.

Story

📰 Binance Crypto Hack Investigation
Technology · 40 article(s) covering the same event. Compare every outlet's account →

Compared with similar articles

This article reads leans strongly right and hedges 0% of its claims. Each row says how that neighbour differs.
Toronto Star
Hedges 0 of 24 claims Outlet record 64/100
NPR
Hedges 1 of 26 claims Outlet record 60/100
BBC News
Hedges 2 of 23 claims Outlet record 68/100
BBC News
Hedges 2 of 23 claims Outlet record 68/100
CBS News
Hedges 0 of 13 claims Outlet record 66/100
“The articles describe different aspects of North Korean cyber activities; one sanctions those involved in IT worker fraud, while the other discusses a major cryptocurrency theft.”
The Sydney Morning Herald
Hedges 7 of 28 claims Outlet record 61/100
BBC News
Hedges 0 of 5 claims Outlet record 68/100
CBC News
Hedges 2 of 27 claims Outlet record 60/100
CBS News
Hedges 1 of 26 claims Outlet record 66/100
How this article was measured signals, leaning charts, publisher record, byline, topics and claims

Signals How these are calculated →

Claims extracted
16
sentences that state something as happening or true
Uncertain
0%
0 of 16 hedged ("reportedly", "may", "according to")
Leaning
Leans strongly right
of the writing, not the subject · beta estimate
Publisher signals
77/100
The Hindu's corrections and hedging, across everything collected from it. Not a measure of accuracy.
Outlets on this story
40
Technology
Same framing elsewhere
1
articles that frame the event the way this one does
Analyzed 2026-10-31 · how these are computed

How this is being covered How these are calculated →

Article leaning vs. publisher reliability
Source leaning vs. consistency

Publisher

The Hindu · 730 article(s) · 2 correction(s) detected
Running correction rate · 2 correction(s)

Who wrote this

Reuters
796 article(s) here · 0 carrying a prediction
🔮 Some have proposed freezing utility rate increases and slashing guaranteed returns, steps that could have sweeping consequences for the country’s utility industry.
🔮 Coinbase said it made adjustments to its systems that store cryptocurrency keys offline “solely out of an abundance of caution”, while Kraken said it was monitoring industry incidents for lessons it could apply to its defences.
🔮 Published Oct. 31, 2026, 2:20 a.m. ET The US State Department said on Friday it had approved the sale of 500 Patriot PAC-3 missiles to Ukraine for an estimated $2.1 billion, in what would be one of the most significant steps to supply defensive weapons to Kyiv since the start of the second Trump administration. Zelensky said on Monday that Ukraine had been waiting for almost a month for the US to sign off on critical missile supplies, as Russia stepped up attacks on energy and civilian infrastructure.
🔮 More than 160,000 people across Germany are expected to join demonstrations on Saturday, organisers say, as a youth-led movement inspired by protests elsewhere in Europe takes to the streets to demand better education and lower living costs.
🔮 “Why would the Field Marshal be going twice if it is not for some positivity?
🔮 “Why would the Field Marshal be going twice if it is not for some positivity?
🔮 Meta had settled with S.J. days before the trial, so Friday’s settlement with K.D.B. means the trial is expected to proceed against Snap only.
🔮 “My duty now is not to focus on discussing whether I will remain in office, but on solving the problem, determining exactly what happened and providing clear explanations,” Puente said at a press conference on Friday.
🔮 The global crypto insurance market was valued at $9.37bn in 2025 and is projected to reach $184.98 billion by 2033, according to Data Bridge Market Research.
2026-10-30 · mixed framing · Binance's $6.3bn hack: How crypto insurance works
🔮 No further victims were expected to be found, regional authorities said.
Wire or desk byline, not an individual reporter.
Also by Reuters
Nothing else under this byline is closely related to this article, so these are simply their most recent.
All 796 articles by Reuters →

Topics

Binance Chainalysis FBI North Korean TraderTraitor

Subjects

North Korean NORP · 7× Barnhart PERSON · 4× Binance ORG · 3× North Korea GPE · 3× TraderTraitor ORG · 3× Chainalysis ORG · 2× FBI ORG · 2× North Korea’s GPE · 2× Russia GPE · 2× TRM Labs ORG · 1×

Narrative

The group also hit Bitget, a separate exchange, taking $387 million in September, experts have said, bringing the minimum total of cryptocurrency North Korea has stolen to roughly $13.5 billion, said Michael Barnhart, a researcher with cybersecurity firm DTEX. Binance said it and others were working to freeze some of the stolen cryptocurrency, with about $3 billion located so far. “After Bitget, a lot of the community expected something like this,” Barnhart said.
framing: assertive · carried by 1 article(s) · first seen 2026-10-31

Claims (16 extracted, 0 hedged)

North Korean hackers likely behind the record $6.3 billion theft from cryptocurrency exchange Binance are among the world’s most prolific crypto thieves, and the proceeds help fund the country’s weapons programs, cybersecurity experts said on Friday. asserted
experts → help → Friday
Blockchain investigation firms TRM Labs and Chainalysis attribute the heist to a North Korean hacking group known as “TraderTraitor,” a name used in a 2022 joint warning from the FBI, CISA and US Treasury that described how hackers used malicious software and other tricks to target software developers and IT staff at cryptocurrency companies. asserted
hackers → attribute → companies
North Korea stole at least $6.75 billion in cryptocurrency through the end of 2025, Chainalysis said in a December 2025 report. asserted
Chainalysis → steal → report
That total includes the $1.5 billion ByBit exchange hack in February 2025. asserted
total → include → February
The group also hit Bitget, a separate exchange, taking $387 million in September, experts have said, bringing the minimum total of cryptocurrency North Korea has stolen to roughly $13.5 billion, said Michael Barnhart, a researcher with cybersecurity firm DTEX. Binance said it and others were working to freeze some of the stolen cryptocurrency, with about $3 billion located so far. “After Bitget, a lot of the community expected something like this,” Barnhart said. asserted
Barnhart → hit → this
TraderTraitor is North Korea’s “most capable hacking group with a primary focus on financials and one staffed by some of the most experienced operators in the regime’s cyber programs in the former APT38 ranks,” he added, referring to North Korea’s long-running financially focused hacking units. asserted
he → staff → units
Researchers say TraderTraitor targets developers and IT staff at financial institutions through malware or phony job offers, tricking candidates into downloading malicious software during fake job interviews, giving the hackers access to login credentials and other sensitive data. asserted
TraderTraitor → say → credentials
Rafe Pilling, a senior director of threat research at Sophos, said early reports of how the hackers compromised Binance match the North Korean playbook, and that the group is expert at working out how a company’s systems and staff approve money transfers. asserted
systems → say → transfers
“This group in particular are somewhat artists in terms of getting into these distributed finance companies,” he said. asserted
he → get → companies
After stealing the money, the hackers pass it to Chinese organised crime money-laundering groups, Barnhart said. asserted
Barnhart → steal → groups
North Koreans also secretly take jobs at tech and financial companies in the US and other countries to earn money to send back to the North Korean government and steal sensitive data, the FBI said in an October 13 public service announcement, adding that money raised by the workers and hackers helps fund North Korean nuclear and military programs. asserted
money → take → programs
A US State Department spokesman said North Korean cybercrime is a “global problem” and that the country has “increasingly turned to cybercrime to circumvent international sanctions and fund its unlawful weapons of mass destruction and ballistic missile programs. asserted
country → say → destruction
Cryptocurrency heists and laundering have become a significant part of this strategy.” asserted
heists → become → strategy
North Korean leader Kim Jong Un has called for the country to seize “absolute superiority” in drone and other military technology, and the drone program’s gains are directly tied to the heists and the overseas IT worker schemes, Barnhart said. asserted
Barnhart → call → heists
The country is also aiding Russia’s war effort, he added. asserted
he → aid → effort
“North Korea has sent troops, munitions, and weapons components to Russia, all funded through the same system, which is why a crypto hack is a national security issue and not only a problem for the exchange that got hit,” Barnhart said. asserted
Barnhart → send → exchange
💬Give feedback
🕘History 🎫Support