North Korean Hackers Steal $6.3 Billion From Binance in Record Crypto Heist

North Korean state-sponsored hackers known as TraderTraitor stole a record $6.3 billion in cryptocurrency from Binance in the world's largest crypto heist, using AI tools as part of a Big Game Hunting strategy that has generated revenues funding nearly half of the country's banned weapons programs.

Record Binance Hack Attributed to North Korean Group

The TraderTraitor group, which the FBI blames for the recent theft, carried out the breach by compromising a Binance engineer's laptop. [1] In just 20 minutes, the hackers stole US$6.36 billion in cryptocurrency. [1] Binance worked with industry partners, including stablecoin issuers, to swiftly freeze almost half the stolen funds. [3] The Federal Bureau of Investigation has attributed the exploit to North Korean hackers. [3] Binance restored customer withdrawals on Sunday after freezing them in the wake of the incident. [3]

TraderTraitor's Big Game Hunting Strategy and AI Tools

TraderTraitor uses a strategy known as Big Game Hunting, cybersecurity experts said, helped by AI to seek out high-value crypto businesses to compromise. [1] With new AI tools the barriers to such skills have dropped significantly, while the speed at which these operations can be carried out has increased tremendously, according to Park Seong-su, staff threat researcher at cybersecurity firm Zscaler. [1] Novel techniques employed by TraderTraitor suggest the group is making ample use of AI in its recent hacks, TRM Labs senior investigator Nick Carlsen said. [1] Their previous largest hack was last year’s US$1.5 billion Bybit heist. [1] They have been known to identify employees with high-level access to target systems and aggressively pursue them with things such as lucrative job offers, Carlsen said. [1] Their bread and butter is the human part, he said. [1]

North Korea's Hacker Army and Revenue Impact

Nuclear-armed North Korea maintains a thousands-strong hacker army, but the top unit known as TraderTraitor might only have a dozen or so members, experts said. [1] For decades, North Korea has picked its best and brightest students to join its hacking teams, training them at specialized institutions such as Moranbong College in Pyongyang, defectors and experts said. [1] The group is now believed to be responsible for 89 percent of reported crypto hack losses this year, according to Chainalysis. [1] From running laptop farms in the US to stealing billions of crypto in less than 30 minutes, its hackers have become one of the most important sources of revenue for North Korea. [1] North Korea’s other income sources, such as trade with China and even the military relationship with Russia, are dwarfed in significance by crypto cash. [1] Once, Pyongyang was smuggling cigarettes and forging US dollar bills to stay afloat — now its hackers bring in billions in pure profit from a single successful heist. [1]

Binance Response and Market Reaction

Net withdrawals from the platform reached $4.7 billion by Monday morning in London, according to a Binance spokesperson. [3] While sizeable, the outflows still represents less than 4% of the $128 billion in assets held on the world’s largest crypto venue. [3] After the hack was first detected on Thursday evening, Binance worked with industry partners to swiftly freeze almost half the stolen funds. [3] The company vowed to cover the losses in full, and as of Sunday, had patched about 95% the total. [3] With roughly US$2.8 billion frozen in its aftermath, net outflows amount to US$3.6 billion. [1]

Broader Security and Geopolitical Context

The crypto market at large has faced a surge in cybercrime this year, fueled in part by the growing sophistication and availability of artificial intelligence tools. [3] Crypto exchanges are beefing up security, especially for employees with key access, to protect against TraderTraitor’s modus operandi of combining top-tier hacking skills with social engineering. [1] In 2024, UN experts said North Korea’s cyberthefts and illicit financial activities could be funding about 40 percent of its weapons of mass destruction programs. [1] For the Kim Jong-un regime, cryptocurrency hacking has evolved beyond merely a criminal means of making up for foreign currency shortages, said Lim Eul-chul, professor at the Institute for Far Eastern Studies, Kyungnam University. [1] As the US devotes significant resources to conflicts in the Middle East and efforts to counter China and Russia, its capacity to actively engage on the Korean Peninsula has diminished. [1] North Korea is exploiting this period as a golden opportunity to accelerate the development of its military capabilities, Lim said. [1] Nuclear weapons and ballistic missiles have always been top priorities for the regime and its cash, but now there seems to be enough to support conventional forces, including new naval vessels, investments in drone tech, said Adam Farrar, a former director on the US National Security Council covering Korea in the administrations of US President Donald Trump and former president Joe Biden. [1] North Korea might still be decades behind South Korea’s military in many ways, but maybe not for much longer, said Farrar, now a senior analyst at Bloomberg Economics. [1]

What to watch next: Crypto exchanges are expected to continue strengthening security measures for employees with key access while the regime’s ability to build out its army and threaten US ally South Korea grows with each successful heist.