[COVER STORY] North Korea has every incentive to keep stealing crypto, analysts say

North Korea-linked hackers stole $6.36 billion from Binance, a cryptocurrency exchange, in an attack analysts said could help fund Pyongyang’s military ambitions. The theft equals 22 percent of North Korea’s 2025 gross domestic product, and analysts said further crypto thefts are likely. Suspected North Korea-linked attacks accounted for nearly 89 percent of reported cryptocurrency-heist losses so far this year, according to Chainalysis. Binance said it had replaced about 90 percent of the stolen amount and planned to restore withdrawals by Sunday.

The average loss per suspected North Korea-linked cyberattack rose from $50.65 million in 2021 to $185.65 million this year.

Chainalysis reported that suspected North Korea-linked attacks accounted for 15 percent of cryptocurrency-heist losses in 2021, compared with nearly 89 percent so far this year.

The FBI and blockchain intelligence firms identified the Binance attackers as TraderTraitor, which the FBI also blamed for the $1.5 billion Bybit heist in February 2025.

North Korea has reportedly trained students with aptitude in mathematics and science in specialized cyberwarfare programs lasting three to five years.

South Korea is working on a digital-asset regulatory framework called the Digital Asset Basic Act, while Bithumb has been among the major Korean companies targeted by cyberattacks.

Published Nov 1, 2026 3:54 pm KST

Updated Nov 1, 2026 5:40 pm KST

Latest $6.3 bil. heist in Binance likely to fund Pyongyang's military ambitions

The $6.36 billion cryptocurrency heist targeting Binance has exposed a troubling reality for the digital asset industry: North Korea is increasingly exploiting security vulnerabilities to bankroll Pyongyang's military ambitions.

The stolen amount is equivalent to 22 percent of North Korea's 2025 gross domestic product, making the attack the largest cryptocurrency theft on record and one of the biggest financial crimes in history.

Analysts warned Sunday that it is unlikely to be the last.

"We're dealing with sophisticated adversaries who may have substantial resources, years of patience and objectives that extend well beyond financial gain," said Michael O'Loughlin, managing partner of Argonautic Global and board member of Blockchain Ireland.

Proceeds from cryptocurrency theft have become an increasingly important source of funding for cash-strapped North Korea, alongside an estimated $22 billion in foreign income generated since 2022 through its support for Russia's war in Ukraine.

The stolen funds could help finance its nuclear and ballistic missile programs, as well as efforts to modernize its conventional forces. Even if roughly half of the stolen assets are ultimately recovered, Pyongyang could still walk away with billions of dollars in additional funding, according to Adam Farrar, senior geoeconomics analyst for Asia-Pacific at Bloomberg Economics.

These financial resources, combined with deepening ties with Moscow and renewed outreach from Beijing, also leave North Korean leader Kim Jong-un with fewer incentives to compromise on his nuclear program, he added.

"Pyongyang has every incentive to keep exploiting gaps in the crypto ecosystem to finance its military ambitions," Farrar said. "The Binance hack will certainly not be the last."

Graphic by Cho Sang-won

North Korea's expanding cyber arsenal

Suspected North Korea-linked cyberattacks account for nearly 89 percent of reported losses in cryptocurrency heists so far this year, compared with just 15 percent in 2021, according to blockchain intelligence firm Chainalysis. The average loss per suspected North Korea-linked cyberattack has nearly quadrupled, from $50.65 million in 2021 to $185.65 million this year.

The U.S. FBI and blockchain intelligence firms identified the figures of the Binance attack as TraderTraitor, an elite North Korean hacking group. The FBI also attributed the $1.5 billion Bybit heist in February 2025 to the same group.

U.S. President Donald Trump commented on the crypto heist on Saturday. "We're learning about it. We don't know if it's North Korea, but if it is, we'll talk to them about it," he told Fox Business.

North Korea has reportedly developed a systematic training program to cultivate a new generation of cyber operatives. Students who show an early aptitude for mathematics and science are selected for specialized cyberwarfare training lasting three to five years, with top performers advancing to elite university programs.

Industry officials warn that advances in artificial intelligence (AI) could make future attacks easier to carry out.

"What has changed is the sophistication of the attacks themselves. TRM analysts have begun to speculate that North Korean operators are incorporating AI tools ... which required weeks of targeted manipulation of complex blockchain mechanisms," blockchain intelligence firm TRM Labs wrote in April.

A North Korean soldier uses a computer at Mangyongdae Revolutionary School in Pyongyang in June 2013. AP-Yonhap

Test of trust for crypto industry

The Binance heist could make a growing number of traditional companies more wary of adopting blockchain technology, according to analysts, as the industry seeks to expand its role in conventional financial markets.

"These attacks damage public confidence because people don't distinguish between a failure of the technology and a failure of the institution protecting their money — nor should we expect them to," O'Loughlin said.

"North Korea's cyber operations demonstrate something important: You don't necessarily need to defeat a financial system to steal from it. Sometimes you only need to compromise one person with the right access. That's why cybersecurity cannot be treated as a technology problem alone. It's a question of people, governance and institutional resilience."

Korea is working on a comprehensive regulatory framework for digital assets, known as the Digital Asset Basic Act. The country has also been grappling with a string of cyberattacks targeting major companies, including Bithumb, its second-largest cryptocurrency exchange.

As cyberthreats grow more sophisticated, analysts say safeguarding the financial system will require not only stronger technological defenses but also closer cooperation among governments, financial institutions and technology providers.

"These cyberattacks are not just a 'crypto' problem; these are a global financial markets and security problem, affecting nearly all of us," said Sandra Ro, CEO of the Global Blockchain Business Council.

The recent Binance attack prompted the world's largest cryptocurrency exchange to suspend withdrawals and pledge to cover all losses. Binance said Saturday that it had replaced about 90 percent of the stolen amount using its own funds and planned to restore withdrawals by Sunday.

Hackers steal $6.3 bil. from Binance in record heist blamed on North Korea

North Korea's evolving threat goes beyond missiles as Russia ties deepen

与朝鲜有关联的黑客从加密货币交易所币安（Binance）窃取了63.6亿美元。分析人士称，此次攻击可能有助于平壤的军事野心。这笔被盗金额相当于朝鲜2025年国内生产总值的22%，分析人士表示，未来很可能还会发生更多加密货币盗窃案。据Chainalysis的数据显示，今年迄今为止，疑似与朝鲜有关的攻击造成的加密货币盗窃损失占已报告损失的近89%。币安表示，已补偿了约90%的被盗金额，并计划在周日恢复提现功能。

疑似与朝鲜有关的网络攻击造成的平均损失从 2021 年的 5065 万美元上升至今年的 1.8565 亿美元。

Chainalysis 报告称，疑似与朝鲜有关的攻击在 2021 年造成的加密货币盗窃损失中占 15%，而今年迄今为止这一比例接近 89%。

FBI 和区块链情报公司将币安攻击者认定为 TraderTraitor，FBI 还指责该组织在 2025 年 2 月对 Bybit 实施了 15 亿美元的盗窃案。

据报道，朝鲜对有数学和科学天赋的学生进行了为期三到五年的专门网络战培训项目。

韩国正在制定一项名为《数字资产基本法》的数字资产监管框架，而Bithumb则是遭受网络攻击的主要韩国公司之一。

发布于2026年11月1日下午3:54（韩国标准时间）

更新于2026年11月1日下午5:40（韩国标准时间）

币安最新发生的63亿美元盗窃案或将为平壤的军事野心提供资金。

币安遭遇的 63.6 亿美元加密货币劫案暴露了数字资产行业一个令人不安的现实：朝鲜正越来越多地利用安全漏洞来资助平壤的军事野心。

被盗金额相当于朝鲜 2025 年国内生产总值的 22%，这使得此次袭击成为有史以来最大的加密货币盗窃案，也是历史上最大的金融犯罪之一。

分析人士周日警告称，这不太可能是最后一次。

“我们面对的是老练的对手，他们可能拥有大量的资源、多年的耐心，而且他们的目标远远超出了经济利益，”Argonautic Global 的管理合伙人兼 Blockchain Ireland 的董事会成员 Michael O'Loughlin 说。

加密货币盗窃所得已成为资金短缺的朝鲜日益重要的资金来源，此外，自 2022 年以来，朝鲜通过支持俄罗斯在乌克兰的战争，估计获得了 220 亿美元的外汇收入。

被盗资金可能用于资助朝鲜的核武器和弹道导弹计划，以及常规部队的现代化建设。彭博经济研究亚太区高级地缘经济分析师亚当·法拉尔表示，即使最终追回约一半的被盗资产，平壤仍可能获得数十亿美元的额外资金。

他还补充说，这些财政资源，加上与莫斯科关系的加深以及北京方面重新加强的接触，也使得朝鲜领导人金正恩在核计划上做出妥协的动力减少。

“平壤完全有动机继续利用加密货币生态系统中的漏洞来为其军事野心提供资金，”法拉尔说。“币安被黑事件肯定不会是最后一次。”

插图：赵相元

朝鲜不断扩大的网络武器库

据区块链情报公司Chainalysis的数据显示，今年迄今为止，疑似与朝鲜有关的网络攻击造成的加密货币盗窃损失占已报告损失的近89%，而2021年这一比例仅为15%。每起疑似与朝鲜有关的网络攻击造成的平均损失几乎翻了两番，从2021年的5065万美元增至今年的1.8565亿美元。

美国联邦调查局和区块链情报公司确认币安攻击事件的幕后黑手是朝鲜精英黑客组织 TraderTraitor。联邦调查局还将 2025 年 2 月发生的 15 亿美元 Bybit 黑客事件归咎于同一组织。

美国总统唐纳德·特朗普周六就加密货币盗窃案发表了评论。他告诉福克斯商业频道：“我们正在了解情况。我们不知道是否是朝鲜所为，但如果是的话，我们会和他们谈谈。”

据报道，朝鲜已制定一套系统性的培训计划，旨在培养新一代网络作战人员。那些在数学和科学方面展现出早期天赋的学生将被选拔出来，接受为期三至五年的专门网络战训练，其中表现优异者将进入精英大学深造。

业内人士警告称，人工智能 (AI) 的进步可能会使未来的攻击更容易实施。

“变化的是攻击本身的复杂性。TRM分析师开始推测，朝鲜攻击者正在使用人工智能工具……这需要数周时间有针对性地操纵复杂的区块链机制，”区块链情报公司TRM Labs在4月份写道。

2013年6月，一名朝鲜士兵在平壤万景台革命学校使用电脑。（美联社-韩联社）

加密货币行业的信任测试

分析人士表示，随着区块链行业寻求扩大其在传统金融市场中的作用，币安被盗事件可能会让越来越多的传统公司对采用区块链技术更加谨慎。

奥洛克林说：“这些攻击损害了公众的信心，因为人们无法区分技术故障和保护他们资金的机构的失职——我们也不应该指望他们能区分。”

“朝鲜的网络行动表明了一个重要事实：你不一定需要攻破金融系统才能从中窃取利益。有时你只需要控制一个拥有合适权限的人。这就是为什么网络安全不能仅仅被视为一个技术问题。它关乎人员、治理和制度韧性。”

韩国正在制定一套全面的数字资产监管框架，即《数字资产基本法》。与此同时，韩国也一直在应对一系列针对大型企业的网络攻击，其中包括其第二大加密货币交易所Bithumb。

分析人士表示，随着网络威胁变得越来越复杂，保护金融体系不仅需要更强大的技术防御，还需要政府、金融机构和技术提供商之间更紧密的合作。

“这些网络攻击不仅仅是‘加密货币’问题；这是一个全球金融市场和安全问题，几乎影响到我们所有人，”全球区块链商业理事会首席执行官桑德拉·罗表示。

币安近期遭受攻击后，这家全球最大的加密货币交易所暂停了提现服务，并承诺赔偿所有损失。币安周六表示，已使用自有资金弥补了约90%的被盗金额，并计划在周日恢复提现服务。

黑客从币安窃取63亿美元，创下历史新高，据称与朝鲜有关。

随着朝鲜与俄罗斯关系的加深，朝鲜的威胁已不再局限于导弹。