A hacking unit behind the biggest thefts

The scale of the operation came into focus when a UN panel of experts reporting to the security council said in spring 2024 that it was reviewing 58 suspected North Korean cyber-attacks on cryptocurrency-related companies between 2017 and 2023, worth $3bn. The suspected hacks were growing in number and size, with as many as 17 recorded in 2023 alone and thefts that year valued at $750m.

Most of the biggest heists are credited to a single unit:

• •Experts including TRM Labs attributed the $6.3bn (£4.7bn) Binance cryptocurrency theft to TraderTraitor, a North Korean hacking group also known as the Lazarus Group.
• •The largest previous crypto theft before that came in February 2025, when $1.5bn was taken from the Bybit exchange - the work, the FBI said, of TraderTraitor.

Where the stolen billions go

The panel's assessment of what the money buys is stark. It estimated that the stolen funds generate half of North Korea's foreign currency income, and one unnamed country told the panel that the stolen cash covers 40% of the weapons of mass destruction programmes.

Kim Jong-un controls a stockpile of about 50 nuclear warheads and has been supplying troops and weapons to help Russia in its war in Ukraine. At the same time, the UN puts 40% of North Korea's population as undernourished, and nearly one in five of its children as stunted.

Why crypto, not banks

Ciaran Martin, former head of the UK's National Cyber Security Centre, argues that North Korea appears to have targeted crypto because traditional banks have developed sophisticated defences, while the lightly regulated crypto sector has not.

"Over the last decade, hackers have walked off with nine- or 10-figure sums from crypto hacks on more than 30 occasions," Martin said, noting that the number of traditional banks suffering cyber-attack losses over $100m in that period is zero or one.

The Bangladesh Bank heist shows the difference. In February 2016, hackers tried to illicitly move $951m from an account the bank had with the Federal Reserve Bank of New York, exploiting time differences. Most transfers were held up - the corresponding bank sat on Jupiter Street, sharing its first word with the name of a sanctioned Iranian ship - and in the end, $81m was stolen.

A decade of state criminal enterprise

The cryptocurrency thefts are the newest chapter in a history stretching back to 2017, when North Korea began targeting lax security in the sector to raise money for its military, including its nuclear weapons programme. The country has long been accused of criminal activity to survive:

• •In the 1990s, it forged high-quality $100 bills known as "supernotes".
• •In the 2000s, it produced and trafficked crystal meth for export.
• •In 2019, its hackers tried to take control of cash machines linked to 56 financial institutions and make them pay out sums well in excess of normal; British officials spotted the plot, alerted banks and it was suppressed with no media coverage.

The hackers themselves are recruited from within. North Korea's internet is severely restricted, with access denied to the general population, and some of the best students in maths and science are recruited into hacker groups such as Lazarus, which operates under the Reconnaissance General Bureau spy agency.

The UN panel reviewing the 58 suspected attacks from 2017 to 2023 reported in spring 2024, as the sums stolen continued to rise.