Seoul — North Korea Funds Weapons Programs With Crypto Theft

A $6.3bn theft from the cryptocurrency exchange Binance, described by analysts as the largest heist in the industry's history, has been traced by blockchain investigators to a North Korean hacking unit known as TraderTraitor, or the Lazarus Group, according to reporting by The Guardian. The link has not been formally proven, the paper notes, but the pattern — a sudden, enormous theft from a crypto platform, followed by rapid attribution to North Korean operatives — has repeated for nearly a decade.

How much has North Korea stolen through crypto hacks?

A United Nations panel of experts reporting to the Security Council said in spring 2024 that it was reviewing 58 suspected cyber-attacks on cryptocurrency-related companies between 2017 and 2023, worth a combined $3bn, according to The Guardian's account of the panel's findings. In 2023 alone, the panel counted as many as 17 suspected hacks totaling $750m, and the paper reports the sums involved have only grown since. The previous record for a single theft was set in February 2025, when $1.5bn was taken in an earlier incident cited by the Guardian.

Who is behind the operation?

The hacking is carried out under the Reconnaissance General Bureau, the country's spy agency, according to the Guardian's reporting, which describes a pipeline in which some of North Korea's top university students are recruited directly into hacker units. Firms such as TRM Labs track the resulting transactions across blockchains, and it was TRM Labs that quickly linked the Binance theft to TraderTraitor, the Guardian reports — the same unit publicly known for years as the Lazarus Group.

How much of the money reaches weapons programs?

The UN panel's estimate is stark: stolen cryptocurrency generates roughly half of North Korea's foreign currency income, according to the Guardian. One unnamed country went further, telling investigators the proceeds fund 40% of the country's weapons of mass destruction programs, the paper reports. Kim Jong-un's government maintains a stockpile of about 50 nuclear warheads and has supplied troops and weapons to Russia's war effort in Ukraine, according to the Guardian's account.

Why does North Korea rely on hacking instead of trade?

The country remains largely cut off from the global economic system, the Guardian notes, and extremely poor — the UN estimates 40% of the population is undernourished and nearly one in five children are stunted, per the paper's reporting. Crypto theft, in that context, functions as a substitute for the foreign trade and investment North Korea cannot access through conventional channels.

What to watch

• Whether blockchain investigators formally confirm TraderTraitor's role in the Binance theft, beyond the initial TRM Labs attribution.
• Whether exchanges tighten security controls that the UN panel says North Korean hackers have repeatedly exploited.
• Whether the Security Council panel's next report updates the $3bn running total or the "half of foreign currency income" estimate.
• Whether sanctions enforcement shifts in response to the scale of the Binance incident, described by the Guardian as the largest crypto heist on record.

For the full account, see The Guardian's original report.