Source: The Conversation – UK
Binance, the world’s largest cryptocurrency exchange, was the victim of a massive heist in late October. Approximately US$6.36 billion (£4.74 billion) of funds were stolen within the space of 20 minutes in an attack that has been described as the largest of its kind in history.
The source of the attack has not yet been officially confirmed. But the FBI and blockchain analytics company TRM Labs identified North Korea’s TraderTraitor hacking unit as the group most likely to have been behind it. Two other blockchain analytics firms, Chainalysis and Elliptic, have supported this attribution.
This is not the first time North Korea has been linked to cyber-attacks. Several other cryptocurrency exchange thefts in recent years have been attributed to North Korean state-sponsored hackers. These include the 2019 Upbit and 2025 Bybit hacks, where funds worth US$42 million and US$1.5 billion respectively were stolen.
Therefore, while Pyongyang has always denied any involvement in state-sponsored cyber warfare, it is not surprising that North Korea has once again been mentioned in connection with a major crypto heist.
State-sponsored hacking
North Korea’s cyber operations are the product of decades of strategic development. The North Korean state began building the technological foundations for these operations in the 1980s, establishing domestic computing infrastructure, specialised educational institutions and state-led research centres.
The development of its cyber capabilities intensified in the 1990s. The Korea Computer Center was set up in 1990 to oversee national IT development. And in 1995, North Korea’s then-leader, Kim Jong-il, directed the military to develop cyber capabilities as a strategic component of national defence.
IT education was further institutionalised from 1998 onward after computer education was made compulsory for all students from the fourth year of middle school.
North Korea began conducting major cyber-attacks in the 2000s. Early operations primarily targeted South Korea. But its cyber operations gradually expanded beyond the Korean peninsula, with the 2017 WannaCry attack a prominent example of this development.
This attack targeted computers running the Microsoft Windows operating system and demanded ransom payments in the form of bitcoin cryptocurrency. It was estimated to have affected more than 300,000 computers across 150 countries, causing billions of US dollars in damage.
North Korea’s state-led cyber operations start with the selection of young students who demonstrate outstanding academic performance, particularly in science and mathematics. These students are provided with specialised computer training at the elite Kumsong Middle School in Pyongyang.
They then advance to one of several colleges, including Mirim College, Moranbong College, Kim Il Sung University or the Kim Chaek University of Technology. In these colleges, students undergo training programmes combining military studies with advanced cyber skills.
As of 2024, North Korea was estimated to have trained roughly 8,400 state-sponsored cyber personnel through these programmes. This figure is likely to have increased since then.
Clear strategic goals
North Korea’s investment in cyber personnel training is driven by clear strategic goals. The main objectives of early North Korean cyber-attacks were to create social disruption in what Pyongyang sees as hostile states.
Examples include the 2013 DarkSeoul attack and the 2014 cyber-attack on Korea Hydro & Nuclear Power. In the DarkSeoul attack, around 32,000 computers belonging to major South Korean broadcasting networks and financial institutions were disrupted by malware.
The attack on Korea Hydro & Nuclear Power involved the theft and disclosure of personal employee information, nuclear power plant blueprints and technical documents. Both attacks aimed to disrupt critical systems and generate public anxiety. They allowed North Korea to exert pressure on its adversaries without engaging in direct military confrontation.
In recent years, however, North Korea’s cyber operations have shifted towards making money. The more recent cyber operations are part of the country’s broader efforts to maintain regime stability and fund its nuclear programme following years of international sanctions.
In 2024, a UN panel of experts estimated that the money stolen in North Korean cyber-attacks generated half of North Korea’s foreign currency income. One unnamed panel member added that stolen money funds “40% of the weapons of mass destruction programmes”.
Several measures are in place to defend against North Korean cyber operations. These include financial sanctions and international efforts to disrupt money-laundering networks. Governments worldwide also work closely with the private sector to exchange intelligence, identify suspicious transactions and trace and recover stolen cryptocurrency.
But the current measures have not been sufficient to prevent attacks. A key reason for this is the fact that international investigations and enforcement remain constrained by national jurisdictions and sovereignty.
As in the physical world, one country cannot access data or conduct an investigation within another country’s territory without its consent. Digital evidence can be also be quickly deleted or altered, so reliance on international cooperation can make an effective and timely response difficult.
Preventing North Korean cyber operations completely may be unrealistic. But there are several ways to make these activities less profitable and more difficult to carry out. These include strengthening identity verification procedures to prevent North Korean IT workers from gaining employment with false identities.
They also include improving information-sharing between governments and private companies and enhancing cyber resilience. This would minimise the damage to targeted organisations and help them recover more quickly when attacks occur.
Ultimately, the goal should not only be to prevent attacks, but also to disrupt the networks that enable them, limit the financial gains and reduce their impact.
Jinkyung Baek does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.
Original source: https://analysis1.mil-osi.com/2026/11/03/how-north-korea-became-a-world-leader-in-state-sponsored-hacking/