North Korea is increasingly turning to sophisticated cyberattacks and cryptocurrency thefts to generate foreign currency and finance its military ambitions, including its nuclear weapons programme, despite being largely isolated from the global financial system. The country’s growing dependence on digital theft has raised concerns among international security experts, who believe billions of dollars stolen from cryptocurrency platforms are helping sustain its weapons development.
The latest major incident involves the theft of cryptocurrency worth an estimated $6.3 billion from Binance, one of the world’s largest cryptocurrency exchanges. Cybersecurity experts at TRM Labs have linked the suspected attack to TraderTraitor, an elite North Korean hacking unit also associated with the notorious Lazarus Group. Although the attribution has not been conclusively established, investigators say the methods used resemble previous cyber operations linked to Pyongyang.
North Korea has been suspected of carrying out cryptocurrency-related cyberattacks since 2017, exploiting security weaknesses in the relatively young and lightly regulated digital currency industry. The stolen money is believed to provide an important source of foreign exchange for the cash-strapped country, helping it finance military activities and its nuclear arsenal.
A United Nations panel of experts reported in 2024 that it was examining 58 suspected cyberattacks targeting cryptocurrency-related companies between 2017 and 2023. The attacks were collectively estimated to have resulted in losses of around $3 billion. According to the panel, proceeds from cryptocurrency theft account for approximately half of North Korea’s foreign currency earnings. Estimates from one country cited in the report suggested that the stolen funds could be financing about 40% of the country’s weapons of mass destruction programmes.
The scale of these operations has continued to increase. North Korean hackers were suspected of carrying out as many as 17 cryptocurrency thefts in 2023 alone, involving approximately $750 million. In February 2025, the Bybit cryptocurrency exchange suffered a theft of $1.5 billion, which the US Federal Bureau of Investigation attributed to the TraderTraitor group.
Experts believe North Korea has increasingly targeted cryptocurrency businesses because conventional banking institutions have strengthened their cybersecurity systems over the years. Ciaran Martin, former head of the UK’s National Cyber Security Centre, has pointed out that large-scale financial losses from cyberattacks have been far more common in the cryptocurrency sector than in traditional banking.
North Korean hackers had earlier demonstrated their ability to target conventional financial institutions. In February 2016, they attempted to steal $951 million from an account held by Bangladesh Bank with the Federal Reserve Bank of New York. The operation exploited differences in international banking hours to facilitate fraudulent transfers. However, an unusual banking detail helped prevent most of the transactions from going through. Ultimately, around $81 million was stolen.
The country’s alleged involvement in cybercrime is part of a longer history of activities aimed at generating money despite international isolation. North Korea has previously been accused of producing counterfeit US currency, including high-quality $100 notes known as supernotes, and engaging in the production and trafficking of crystal methamphetamine for export.
Interestingly, while internet access remains heavily restricted for ordinary North Korean citizens, the government has invested in developing technical expertise among selected students. Some of the country’s brightest mathematics and science students are reportedly recruited into specialised hacking units during their university years. These groups operate under the supervision of the Reconnaissance General Bureau, North Korea’s intelligence agency.
The Lazarus Group has also been linked to politically motivated cyberattacks. In December 2014, hackers targeted Sony Pictures Entertainment after the studio supported the production of The Interview, a comedy film depicting an assassination plot against North Korean leader Kim Jong-un. The attack resulted in the leaking of thousands of internal emails and confidential company information, creating a major controversy for the Hollywood studio.
With North Korea facing severe economic challenges, cryptocurrency theft has emerged as an increasingly significant source of revenue. While a large section of its population continues to face food shortages and economic hardship, the money generated through cyber operations is believed to be supporting the country’s military expansion and nuclear ambitions, making digital security an increasingly important part of international efforts to contain Pyongyang’s weapons programme.
