Five Things to Know About North Korea’s TraderTraitor Hacking Group Behind Major Crypto Thefts

North Korea's TraderTraitor hacking group has been blamed by United States authorities for stealing more than $6 billion in virtual assets from cryptocurrency exchange Binance, in what is described as one of the largest crypto thefts in history.

The October 29 attack is the latest in a series of major cyber thefts linked to Pyongyang. Authorities and security analysts believe proceeds from such operations help the country generate foreign currency and support its weapons development programmes.

Here are five important things to know about the hacking group and its role in North Korea's cyber operations.

1. Who Are TraderTraitor?

TraderTraitor is the name given to a North Korean hacking operation linked to the broader Lazarus Group, which became widely known after the 2014 cyberattack on Sony Pictures.

The attack was reportedly carried out in retaliation for the release of the film “The Interview”, a comedy that mocked North Korean leader Kim Jong Un.

North Korea has invested heavily in cyber capabilities since the mid-1990s. South Korean intelligence estimated in 2024 that the country had around 8,400 cyber personnel, with many recruited from top academic institutions.

The operations are believed to be directed largely through the Reconnaissance General Bureau, North Korea's main foreign intelligence agency.

2. How Do They Carry Out Their Attacks?

TraderTraitor hackers often use fake recruitment opportunities to trick victims into downloading malicious software.

In some cases, attackers pose as recruiters offering attractive jobs and send applicants what appear to be legitimate employment assessments. These files contain malicious code that allows hackers to access computer systems and steal sensitive information or digital assets.

One example was the 2024 theft of $308 million from Japanese cryptocurrency exchange DMM Bitcoin. According to the FBI, a North Korean hacker posing as a recruiter on LinkedIn targeted an employee of a virtual currency wallet software company. A malicious code hidden in a supposed pre-employment test helped compromise the employee's system.

3. What Major Cyberattacks Have Been Linked to North Korea?

North Korean hacking groups have been linked to several major cyberattacks over the past decade, including:

• 2016: The theft of $81 million from Bangladesh's central bank.
• 2017: The WannaCry ransomware attack, which disrupted computer systems worldwide.
• 2022: The theft of approximately $620 million from the Ronin blockchain network.
• 2023: Nearly $200 million stolen from Atomic Wallet, Alphapo and CoinsPaid in attacks attributed to TraderTraitor.
• 2024: The theft of $308 million from Japanese exchange DMM Bitcoin.
• 2025: The FBI attributed the theft of approximately $1.5 billion from cryptocurrency exchange Bybit to TraderTraitor.

These incidents have made North Korean-linked hacking operations a major concern for cryptocurrency platforms and international cybersecurity authorities.

4. How Does North Korea Use the Stolen Funds?

Experts say stolen cryptocurrency is often laundered through mixing services and private exchanges before being converted into cash.

Lim Eul-chul, a professor at Kyungnam University's Institute for Far Eastern Studies, told AFP that the proceeds are channelled towards military research, the procurement of weapons components and the country's defence industry.

A 2024 United Nations report also noted that proceeds from North Korean cyberattacks had reportedly helped finance the country's weapons of mass destruction development programmes.

5. Why Does North Korea Rely on Cybercrime?

Analysts say cyber theft offers North Korea a way to generate substantial foreign currency despite international sanctions restricting its access to conventional financial and trade systems.

According to Lim, hacking allows Pyongyang to obtain large sums of money with relatively few personnel and limited resources.

The use of cryptocurrency also provides opportunities to move funds across borders outside traditional banking channels, making cybercrime an important source of revenue for the heavily sanctioned country.

Channels Television