COMMENTARY: North Korea doesn’t need to break the international financial system when it can exploit the gaps between its parts.
Shut out of conventional banking by sanctions, DPRK threat groups have continued developing alternative ways to generate hard currency, from cryptocurrency theft and fraudulent IT employment to prohibited commodity trading.
[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
The reported $6.36 billion theft from Binance represents the most dramatic example, but it reflects a strategy refined over several years: identify where valuable assets intersect with fragmented oversight, trusted access, and inconsistent controls.
According to TRM Labs, an attacker moved approximately $6.36 billion from Binance wallets across 10 blockchains on October 29, with most of the transfers occurring in about 20 minutes. TRM attributed the operation with high confidence to TraderTraitor, the North Korean unit previously identified by the FBI as responsible for the $1.5 billion Bybit theft in February 2025. And just yesterday, the FBI also confirmed the heist was done by the North Koreans.
Although Binance has not yet published a complete root-cause analysis, TRM’s attribution offers a credible basis for understanding the operation within North Korea’s broader campaign of cryptocurrency theft.
Debunking crypto cyber crime myths
While it’s tempting to say that North Korean adversaries are focused on crypto because the industry is less secure than mainstream banking, cryptocurrency has actually become increasingly regulated. In July 2026, the Financial Action Task Force reported that 83% of surveyed jurisdictions had passed legislation implementing the Travel Rule for virtual assets, meaning cryptocurrency exchanges must verify identifying information about the sender and the recipient when a transaction occurs. Uneven implementation represents the more consequential problem: significant gaps remain in licensing, supervision, and enforcement, particularly around offshore service providers, decentralized finance and peer-to-peer activity involving unhosted wallets. Attackers haven’t needed the entire ecosystem to be unregulated, only enough seams through which they can move, exchange, or launder assets.
It's also not necessarily harder to trace cryptocurrency. Public blockchains create persistent records that let investigators follow funds across addresses and services. That visibility helped stablecoin issuers and industry partners freeze approximately $2.7 billion connected to the Binance theft. The challenge: intervening before funds move again, identifying who controls a wallet, coordinating action across jurisdictions, and recovering assets once an attacker converts them into forms that no central issuer can freeze.
The great state-sponsored hacking machine
For North Korea, cryptocurrency theft operates as one component of a diversified sanctions-evasion and revenue-generation strategy. The regime has long used deceptive maritimenetworks to export prohibited commoditiessuch as coaland import restricted petroleum. U.S. and UN authorities have documented vessels conducting ship-to-ship transfers, concealing their names and identifying markings, manipulating tracking data, falsifying documentation, and using companies in third countries to obscure North Korea’s role. UN Security Council Resolution 2371 imposed a full ban on North Korean coal exports, while subsequent enforcement actions identified vessels and trading companies involved in continuing the trade.
The same logic stands in DPKR’s fraudulent IT-worker operations. North Korean workers use stolen identities and fabricated personas to secure employment with legitimate businesses, after which the regime appropriates a significant portion of their wages. Some have also used corporate access to introduce malware, steal sensitive information, and extort their employers. The U.S. Department of the Treasury says these operations generate hundreds of millions of dollars for North Korean weapons programs.
These activities look operationally different, but they serve the same purpose: generate foreign currency outside the conventional financial system while concealing the North Korean state’s involvement. Coal must be extracted, transported, transferred between vessels and sold through intermediaries. Fraudulent IT work requires identity infrastructure, facilitators, and continued access to employers. Cryptocurrency theft can compress that revenue chain, allowing a successful intrusion to produce billions of dollars in transferable assets within minutes.
That’s what makes the Binance incident relevant to security professionals. TRM Labs assesses that the attacker likely gained the ability to make Binance’s hot-wallet signing infrastructure authorize transactions across multiple blockchains. In other words, the attacker may not have needed to defeat the underlying cryptography. Compromising the process trusted to use it was enough, and North Korean cyber operations have increasingly matured in exploiting trust.
Security teams need to look beyond whether a user, device, or transaction has valid credentials. They must focus on what that identity can authorize, whether sensitive actions receive independent validation, and how quickly they can contain access. High-value workflows require separation of duties, hardened administrative endpoints, just-in-time privileges, behavioral monitoring, transaction limits, and pre-approved mechanisms for stopping abnormal activity.
The ultimate lesson is not that every organization must defend itself like a global bank or cryptocurrency exchange: it's that motivated adversaries will identify where trust concentrates and controls become fragmented. Defenders can’t eliminate every fissure, but they can prevent one compromised identity, endpoint, or workflow from gaining unilateral authority over the organization’s most valuable assets.
Justin Moore, director of adversary operations, Arctic Wolf
SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
