North Korean hacking unit linked to $6.3bn Binance theft that fuels regime’s foreign earnings

Experts have quickly linked the $6.3bn Binance cryptocurrency theft to TraderTraitor, an elite North Korean hacking unit also known as the Lazarus Group, according to The Guardian. The same outlet notes that cryptocurrency theft is estimated to generate about half of North Korea’s foreign currency income. The isolated, secretive and autocratic country is largely cut off from the world’s economic system, but it turns to sophisticated hacking to raise foreign earnings. TRM Labs and other analysts identified a pattern of behaviour that matches previous attacks attributed to the group, though the link has not been definitively proven. The theft underscores how the regime relies on cybercrime to fund its activities, including its nuclear programme.

Why it matters

The case shows that crypto theft is a major source of revenue for North Korea, helping to finance its nuclear ambitions and posing a security risk to the global cryptocurrency ecosystem.

Key details

Location

North Korea · Asia

Reported by

The Guardian

First reported

30 Oct 2026, 23:07 IST

Key names

TRM Labs, Binance, TraderTraitor, North Korean

Section

World

Sources

This is an independent summary. Read the full, original reporting from the publisher:

• The GuardianHow crypto hacking funds isolated North Korea’s nuclear programme 30 Oct, 23:07

Read the full story at The Guardian ↗

Spotted an error? Request a correction · How this summary was produced