North Korea’s TraderTraitor hacking group has been blamed by US authorities for stealing more than US$6 billion (S$7.7 billion) in virtual assets from Binance, in what is believed to be the largest crypto heist in history.
asserted
what → blame → history
The Oct 29 attack is the latest in a string of high-profile cyber thefts linked to Pyongyang, which has built a formidable hacking operation, generating funds believed to help finance its weapons programme.
asserted
which → link → programme
Here are five things to know about the group and its place in North Korea’s cyber warfare programme:
Who are they?
TraderTraitor is the name given to a North Korean hacking operation linked to the broader Lazarus Group, which gained notoriety in 2014 when it hacked Sony Pictures in retaliation for The Interview, a satirical film that mocked North Korean leader Kim Jong Un.
asserted
that → know → Un
Pyongyang has invested heavily in developing its cyber capabilities since at least the mid-1990s, building a formidable force that South Korean intelligence estimated in 2024 comprised around 8,400 personnel.
asserted
intelligence → invest → personnel
“North Korea has built a capable cyber force, funnelling many of the country’s top students into computer science and IT training,” the FBI said on its website.
asserted
FBI → build → website
Much of the hacking activity is known to have been directed by Pyongyang’s Reconnaissance General Bureau, its primary foreign intelligence agency.
“The top two students in my class were recruited to the hacking unit,” South Korean MP Park Choong-kwon, who studied at the North’s elite National Defense University before his defection, told AFP in a 2024 interview.
asserted
who → know → interview
How do they operate?
asserted
they → operate → ?
TraderTraitor actors have been known to pose as recruiters offering lucrative jobs to trick victims into downloading malicious software.
asserted
actors → know → software
The malware can allow hackers to infiltrate victims’ computer systems and steal sensitive information and digital assets.
asserted
hackers → allow → information
In a 2024 heist involving the theft of US$308 million from Japanese cryptocurrency exchange DMM Bitcoin, a North Korean hacker posing as a recruiter on LinkedIn contacted an employee of a separate virtual currency wallet software company.
asserted
hacker → involve → company
They sent the employee what appeared to be a pre-employment test, which actually contained a malicious line of code.
asserted
which → send → code
That allowed the hacker to compromise their system and impersonate the employee, the FBI said.
asserted
FBI → allow → employee
What have North Korean hackers done?
asserted
hackers → do → What
High-profile cyberattacks attributed to North Korean hackers include the theft of US$81 million from Bangladesh’s central bank in 2016 and the WannaCry ransomware attack that disrupted computers worldwide in 2017.
asserted
that → attribute → 2017
In 2022, US authorities blamed Lazarus-linked hackers for stealing around US$620 million from the Ronin blockchain network.
asserted
authorities → blame → network
The FBI subsequently attributed three more cryptocurrency heists in 2023 to TraderTraitor actors, involving the theft of nearly US$200 million from Atomic Wallet, Alphapo and CoinsPaid.
asserted
FBI → attribute → Wallet
The scale of the thefts increased dramatically in February 2025, when the FBI blamed TraderTraitor for stealing around US$1.5 billion in virtual assets from cryptocurrency exchange Bybit.
asserted
FBI → increase → Bybit
“TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets,” the FBI said at the time.
asserted
FBI → proceed → time
How does North Korea use stolen funds?
asserted
Korea → use → funds
The North Korean regime launders stolen cryptocurrency and converts it into cash “through mixing services or private exchanges”, Lim Eul-chul, a professor at the Institute for Far Eastern Studies at Kyungnam University, told AFP.
“The proceeds are then channelled directly into military research, the illicit procurement of weapons components and the defence industry,” he added.
asserted
he → launder → components
A 2024 United Nations report said proceeds from North Korean cyberattacks “reportedly helped to fund the country’s development of weapons of mass destruction”.
uncertain
proceeds → say → destruction
Analysts say Pyongyang’s illicit cyber activity is driven by its ability to obtain vast sums of money quickly and at “minimal cost”.
asserted
activity → say → cost
“While international sanctions severely restrict North Korea’s ability to earn foreign currency through conventional trade, cyber theft allows it to acquire billions of dollars with minimal personnel and resources,” said Lim of Kyungnam University.
asserted
Lim → restrict → University
“Hacking offers Pyongyang a way to obtain funds outside conventional banking channels, taking advantage of the pseudonymous and borderless nature of digital assets to bypass financial restrictions,” he added.
asserted
he → offer → restrictions
The Aporia
