The U.S. Federal Bureau of Investigation (FBI) said on October 31 that North Korea was responsible for the theft of more than $6 billion in digital assets from Binance – the largest cryptocurrency exchange in the world by trading volume. The FBI labeled the hacking operation behind the attack TraderTraitor.

According to the blockchain analysis firm TRM Labs, the attackers moved about $6.36 billion out of the wallets of Binance on 10 blockchains. That would make the theft the largest on record, according to the firm. Most of the money left in about 20 minutes, starting from around 4:00 p.m. U.S. Eastern time on October 29. 

Binance said that it had frozen about $3 billion of the stolen assets and it pledged to cover all losses. The company halted withdrawals after the attack, and began a “phased resumption” on November 1. Meanwhile, the explanation of the cause grew more complicated. At first, Binance pointed to a compromised laptop that belonged to an engineer. Later, the company disclosed that its investigation had found more points of breach.

U.S. President Donald Trump told reporters at his residence in Florida on October 31 that “we don’t know if it’s North Korea.” However, the FBI seems more sure. It previously blamed the same hacking operation, TraderTraitor, for the theft of about $1.5 billion from the exchange Bybit in February 2025. The Binance haul is more than four times as large as that sum.

Pyongyang has been building toward such a massive cyber heist for years. Over the past decade, North Korea has steadily built a hacking apparatus whose main purpose is to raise money for the Kim regime.

Back in 2019, the U.S. Treasury Department said that the Reconnaissance General Bureau, the main intelligence organization of North Korea, controls Lazarus Group, the name cybersecurity firms use for several North Korean hacking units. The Lazarus Group’s activities date back to at least 2007.

From the start, Lazarus Group built its reputation through disruption. In 2018 the Justice Department charged a North Korean programmer named Park Jin Hyok in connection with the 2014 attack on Sony Pictures Entertainment, the 2017 WannaCry outbreak, and a 2016 bank theft in Bangladesh. In that last case, hackers used stolen credentials to request $851 million in transfers from the account of the central bank of Bangladesh at the Federal Reserve Bank of New York. About $80 million went through before a typographical error alerted staff to stop the rest.

North Korea began to focus its hacking operations on cryptocurrency theft around 2017, according to the Multilateral Sanctions Monitoring Team, a group of 11 countries that includes the United States, South Korea and Japan. As the monitoring team noted, (using the abbreviation of North Korea’s formal name, the Democratic People’s Republic of Korea),  “The DPRK employs its cyber capabilities to circumvent UN sanctions and generate revenue for the DPRK’s priorities, including the unlawful development of its WMD and ballistic missile programs.” Back in 2017, North Korea faced a weak economy and tightening sanctions, and the young crypto industry lacked mature security. So the motive and the opportunity lined up. 

Between 2016 and 2017 the Reconnaissance General Bureau formed a specialized team to steal cryptocurrency after earlier hacking units had succeeded against banks and the SWIFT system. Researchers once called that North Korean hacking team APT38 or Bluenoroff. But the monitoring team now says that it comprises two groups called TraderTraitor and CryptoCore. TraderTraitor is the actor that the FBI linked to both Bybit and Binance.

For TraderTraitor, a cyber attack usually begins by seeking entry to a single employee computer. In 2022, the FBI, the Cybersecurity and Infrastructure Security Agency, and the Treasury Department warned that the group sends large numbers of spearphishing messages to employees of crypto companies – usually system administrators and software developers. Spearphishing involves sending targeted messages that look personal and trustworthy. In practice, the messages often imitated a recruitment effort and offered high-paying jobs. 

The attack on Bybit in February 2025 followed that script. The hackers posed as recruiters and sent a developer at the wallet provider Safe{Wallet} a fake pre-employment test that carried malicious code. The test likely gave them access to the internal network of the company. Using that access, on February 21 they altered the screen where Bybit users give approval for transfers. The users thought that they were approving a routine transfer; in fact, they were handing control of an offline wallet of the exchange to the hackers.

The original explanation offered by Binance – that a single infected computer started the attack – fits the same pattern. Binance and Bybit aren’t the only victims, either. Since mid-2024, TraderTraitor has targeted outside companies that hold keys for crypto exchanges. Those attacks produced at least $2 billion in thefts from Bybit, DMM Bitcoin in Japan, and WazirX in India, according to the Multilateral Sanctions Monitoring Team. 

North Korea stole at least $2.84 billion in cryptocurrency from January 2024 to September 2025. TraderTraitor alone accounted for about $2.58 billion of that total

The thefts in 2024 alone totaled at least $1.19 billion – equivalent to about one-third of the foreign currency earnings of North Korea that year, according to the monitoring team. And that figure only includes hacks that could be attributed to North Korea with near certainty. The real total may be higher.

The Binance theft involved more than $6 billion. That’s over twice as much, in a single heist, as the total stolen  from January 2024 to September 2025. 

Of course, stealing the coins is only half of the work; the attackers must then withdraw the funds. The hackers obscure the money trail with mixers, bridges, and decentralized exchanges. In short, these services shuffle coins across accounts and networks. Then brokers in third countries turn the coins into cash.

The monitoring team noted that all of the money from Bybit had been converted into cash or hard currency by September 2025, about seven months after the original hack. In the Binance case the FBI observed that the hackers converted most of the stolen assets into Ethereum, likely as a first step to further laundering through decentralized finance and instant swap services.

The stage that turns stolen coins into spendable money relies heavily on China. The monitoring team found that North Korea used at least 15 Chinese banks to launder funds from heists and information technology (IT) work. North Korean units also depended on over-the-counter traders in China to convert stolen coins into cash. 

China’s involvement goes beyond banking services. The Korea Herald, one of the main Korean newspapers reporting news in English, reported that Chinese nationals supplied forged identification documents to North Korean cyber groups. North Korean units used UnionPay cards and commercial banks in China to convert the proceeds into cash. Also, North Korea keeps 1,000 to 1,500 IT workers in China who earn foreign currency for the state. Then in September, the monitoring team noted that a North Korean diplomatic mission in China had reportedly cashed out stolen cryptocurrency through Chinese collaborators as of November 2025.

Beijing has applied pressure in some places. The monitoring team added that tighter anti-money-laundering checks at Chinese banks and crackdowns on illegal brokers had made the old money-exchange routes harder. Also, Chinese authorities have stepped up surveillance of North Korean IT workers. Chinese public security officers reportedly detained one such worker in April 2025 for allegedly stealing Chinese military secrets.

Governments involved in the monitoring team gave Beijing most of the China-related information in the 2025 report during 2024, and that information included the identities of North Korean and Chinese nationals involved in the illegal activities.

Nevertheless, loopholes remain. China remains the main hub where stolen coins become cash. In September, the monitoring team still described China as the primary hub for money laundering. In fact, China reportedly began to issue more trainee, student, and border-crossing visas to North Koreans after a diplomatic thaw in 2025. Past precedent shows that North Korean IT workers – and hackers – often enter China on trainee or student visas.

In short, Beijing has tightened the checks that protect its own banks from secondary sanctions, but Pyongyang keeps a working cash-out route inside China. Beijing has yet to face any real consequences for its enabling role.

Therefore the response to the Binance theft will test a weak point. The FBI has asked private companies to block transactions that involve listed Ethereum addresses. However, a block works only where the company at the end of the chain cooperates. Thus, the weak points are the brokers and banks that sit outside the reach of the FBI. Until Beijing closes the exits that remain, the next record theft is likely to still wind up in North Korea’s state coffers.