[Edaily Reporter KIM YOON JI ] The U.S. Federal Bureau of Investigation (FBI) has identified North Korea as the mastermind behind a $6.3 billion (approximately 8.4 trillion won) hacking incident at the cryptocurrency exchange Binance. Concerns are also growing that North Korea’s cyberattacks could become even more sophisticated due to recent advances in artificial intelligence (AI) technology.
◇ U.S. FBI Confirms “North Korea Behind the Attack” for the First Time
On the 31st (local time), the FBI stated in a press release, “North Korea is responsible for the theft of more than $6.3 billion in cryptocurrency from Binance.” Although North Korea had been cited as the culprit since the incident occurred, this marks the first time U.S. authorities have officially confirmed this.
The FBI stated that “TraderTraitor,” a North Korean elite hacking group, led the attack and that it had detected evidence that the group was converting the stolen assets into Ethereum (ETH). The FBI anticipates that the group will use decentralized finance (DeFi) and instant exchange services to convert additional assets and prepare for the next stage of money laundering.
Accordingly, the FBI urged private-sector businesses to block transactions related to addresses used by the “TraitorTraitor” group to launder stolen virtual assets, as well as transactions derived from those addresses.

Binance stated that on the 30th of last month, a hacking incident occurred in which virtual assets were withdrawn without authorization, adding that the estimated total loss amounts to $6.3 billion. This marks the largest single hacking incident in the history of the virtual asset industry.
The Financial Times (FT) assessed North Korea as “cut off from the outside world, yet having grown into one of the world’s most threatening attackers in cyberspace.”
Experts warn that North Korea is stealing vast sums of money through cyberattacks to fund its military and nuclear weapons development programs. North Korea’s illicit foreign currency-raising methods have evolved over time. After counterfeiting currency in the 1990s and drug trafficking in the 2000s, North Korea has been targeting the cryptocurrency market since the 2014 Sony Pictures hack. North Korean hacking groups, including Lazarus, have targeted the Ronin Network ($620 million) in 2022, DMM Bitcoin (approximately $308 million) in 2024, and Bybit ($1.5 billion) last year, stealing massive sums in a series of attacks.
◇ North Korean Hacking: Bypassing Sanctions to Fund Weapons
Facing international sanctions, North Korea began to focus on cyberattacks. In 2024, a United Nations Security Council panel of experts estimated that revenue from North Korean cyberattacks between 2017 and 2023 accounted for about half of the country’s total foreign exchange earnings. Analyses have also suggested that a significant portion of the funds stolen by North Korea is used for weapons development, covering about 40% of the costs of its nuclear and missile programs.
North Korean hacking groups drew significant international attention following the 2014 Sony Pictures hack. Ahead of the release of the film *The Interview*, which depicted the assassination of North Korean Chairman Kim Jong-un, Sony Pictures’ computer network was attacked, resulting in the leak of internal documents and a massive amount of data. U.S. authorities identified the Lazarus Group, supported by the North Korean regime, as the culprit.
In 2016, an attempt was made to steal approximately $1 billion (about 1.3 trillion won) from an account held by the Central Bank of Bangladesh at the Federal Reserve Bank of New York. Although the operation was halted midway, the hackers managed to siphon off $81 million (about 108.1 billion won).
Since then, as the cryptocurrency market has grown rapidly and traditional banks have strengthened their cybersecurity, North Korea’s targets have expanded to include cryptocurrency exchanges and other entities. According to blockchain analytics firm TRM Labs, North Korea is estimated to have stolen $12.8 billion (approximately 17 trillion won) worth of cryptocurrency through about 100 hacking incidents since 2017. Of this total, the amount stolen this year—including the Binance incident—reaches $7.4 billion (approximately 9.8 trillion won). This figure represents the total amount stolen, excluding funds frozen after the hacking incidents were disclosed.
◇Nurtured from Childhood…State-Level Cyber Warfare
The FT analyzed that North Korea’s state-level talent development system underpins these activities. It is reported that North Korea selects students who show exceptional talent in mathematics and science from a young age and provides them with specialized cyber warfare training.
After undergoing intensive training for three to five years, the most promising students advance to specialized university programs. Some elite operatives are reportedly sent to China and Russia for additional training.
In a report released this year, the North Korean Human Rights Committee revealed that Moranbong University in Pyongyang operates a five-year curriculum combining military studies with hacking and cryptanalysis. It is estimated that approximately 8,400 people, including support staff, are involved in North Korea’s cyber operations.
Shin Beom-chul, a former vice minister of defense, told the FT, “North Korean hackers are among the most aggressive and skilled cyber actors in the world,” adding, “Because they face no accountability at home, they can actively target and hack foreign institutions.”
The scale of North Korea’s hacking activities is growing rapidly. According to a report by blockchain analytics firm Chainalysis, the value of virtual assets stolen by North Korea rose from $1.34 billion (approximately 1.7 trillion won) in 2024 to $2.02 billion (approximately 2.6983 trillion won) last year.
In particular, this incident occurred amid growing concerns about AI-powered cyberattacks. Simon Choi, Chief Technology Officer (CTO) of Stealthmall, warned that advancements in artificial intelligence (AI) have made it even more likely that North Korea’s cyberattacks will increase. “AI has given hackers wings by helping them identify vulnerabilities and automate attacks,” he said, adding, “Given North Korea’s strong determination to carry out cyberattacks, it’s as if the gates of hell have opened.”