North Korean leader Kim Jong Un attends a drone exhibition in Kangwon Province on Oct 29 North Korea has built a billion-dollar cyberwar machine that allows it to target global financial institutions, steal cryptocurrency and generate revenue despite sweeping international sanctions.Its state-sponsored hackers, suspected of carrying out the $6.3 billion Binance heist, have repeatedly exploited weaknesses in cryptocurrency exchanges and technology companies, turning cyberattacks into a major source of illicit foreign currency for Pyongyang.According to blockchain intelligence firms TRM Labs and Chainalysis, the October 29 attack on Binance bears the hallmarks of TraderTraitor, a North Korean-linked hacking operation.The suspected involvement of the group has once again brought attention to how Pyongyang’s cyber network operates, how it infiltrates financial institutions and why the isolated country increasingly relies on digital theft to generate funds.TraderTraitor has been associated with the Lazarus Group and other North Korean-linked cyber units involved in cryptocurrency thefts, financial fraud and cyber espionage.In an April 2022 joint cybersecurity advisory, the US Federal Bureau of Investigation identified TraderTraitor as a North Korean state-sponsored advanced persistent threat (APT) group. The advisory said the group was also tracked by cybersecurity researchers under names including Lazarus Group, APT38, BlueNoroff and Stardust Chollima.The FBI has previously attributed several major cryptocurrency thefts to TraderTraitor-affiliated actors, including the $100 million Atomic Wallet theft in June 2023 and the $60 million Alphapo theft the following month. In August 2023, the agency said it had tracked approximately 1,580 Bitcoin stolen in multiple cryptocurrency heists by the group.How do North Korean hackers operate?North Korean hackers increasingly rely on social engineering, fake identities and malicious software to infiltrate cryptocurrency companies, rather than simply attempting to break into their computer networks. Their operations often begin by targeting employees with access to sensitive systems, particularly software developers, IT administrators and DevOps engineers.North Korean cyber actors approach employees of cryptocurrency companies through professional networking and messaging platforms, often posing as recruiters offering high-paying jobs. They persuade targets to download malicious cryptocurrency applications disguised as trading or price-prediction tools, which can give attackers access to company networks and sensitive information.Once inside a company’s network, the hackers seek to obtain access to internal communications, credentials and systems involved in managing digital assets. By compromising employees with privileged access, they can potentially manipulate legitimate financial processes and authorise fraudulent cryptocurrency transfers. The stolen assets are then moved across multiple wallets and blockchain networks, sometimes converted into other cryptocurrencies, to make tracing and recovery more difficult.The FBI’s investigation into the February 2025 Bybit theft showed how the group moved stolen assets into thousands of wallet addresses across multiple blockchains before attempting to convert them into other digital assets and eventually traditional currency.Why does North Korea depend on hackers for funding?North Korea’s growing reliance on cybercrime is rooted in its international isolation, extensive economic sanctions and limited access to conventional sources of foreign currency.With restrictions imposed by the United Nations and Western countries targeting its nuclear and ballistic missile programmes, Pyongyang has increasingly turned to cyber operations to generate revenue outside traditional banking and financial systems.A November 2025 report by the Multilateral Sanctions Monitoring Team (MSMT), comprising countries monitoring North Korea’s sanctions violations, said Pyongyang was systematically using cryptocurrency theft, money laundering and overseas information technology (IT) workers to generate revenue for its state priorities, including its weapons of mass destruction and ballistic missile programmes.The stolen cryptocurrency is subsequently moved through international networks of intermediaries, including overseas North Korean nationals and foreign-based facilitators, before being converted into conventional currencies. According to the MSMT report, these networks have operated across countries including China, Russia, Argentina, Cambodia, Vietnam and the United Arab Emirates, helping Pyongyang move funds for procurement activities and weapons programmes.The scale of the operations has made cybercrime an increasingly important source of revenue for Pyongyang. Reuters reported on October 30 that North Korea had stolen at least $6.75 billion in cryptocurrency through 2025, with subsequent thefts pushing estimates significantly higher.