When investigators and blockchain analysts name North Korean crypto hackers as the prime suspect in a record-making exchange theft, the claim carries unusual weight. The reason is not only the amount stolen. The same actors keep returning, refining their methods and beating defenses built by some of the best-funded companies in the industry. This analysis separates what is documented from what is inferred, and explains why the pattern matters for every exchange, custodian and investor.
One correction first. Some headlines have tied the accusations to Binance. The record-setting heist that the FBI publicly attributed to North Korea is the February 2025 theft from Bybit, worth roughly $1.5 billion in Ether. Binance’s best-known breach, in 2019, involved about 7,000 bitcoin (around $40 million), and to my knowledge authorities have not publicly attributed it to North Korea. The broader argument that Pyongyang’s operators have become the dominant threat to centralized crypto platforms stands either way.
Who the suspected North Korean hackers are
The label usually refers to the Lazarus Group, an umbrella name for state-linked operators that Western governments connect to North Korea’s Reconnaissance General Bureau. Security vendors track sub-clusters under different names, including APT38, which focuses on financial theft, and TraderTraitor, the label the FBI used for the Bybit operation.
The group’s history shows steady escalation:
- 2014: the Sony Pictures hack, a destructive, politically motivated attack.
- 2016: the Bangladesh Bank robbery, which targeted the SWIFT messaging network and netted about $81 million.
- 2017: the WannaCry ransomware attack, which US and UK governments attributed to North Korea.
- 2022: the roughly $620 million Ronin Network theft tied to Axie Infinity, which the FBI attributed to Lazarus.
- 2024: the roughly $305 million DMM Bitcoin theft in Japan, which US and Japanese authorities later linked to TraderTraitor.
- 2025: the Bybit theft, the largest crypto heist recorded so far.
The trajectory shows a shift from disruptive attacks to a disciplined revenue operation. The money is the point.
Why attribution points to Pyongyang
The statistical pattern
Blockchain analytics firm Chainalysis reported that North Korea-linked actors stole about $1.34 billion across 47 incidents in 2024. That was around 61% of all crypto stolen that year. These are the firm’s estimates, built on on-chain tracing and heuristics, but they are consistent with government assessments and with other analytics providers. A single state-backed cluster accounting for most of the global theft total is unusual in any criminal market.
The forensic evidence
Attribution rarely rests on one proof. Analysts typically combine several indicators:
- Reused infrastructure: wallet addresses, servers and malware components that overlap with earlier confirmed operations.
- Laundering signatures: consistent sequences of swaps, bridge hops and cash-out routes.
- Tradecraft: long-running social engineering aimed at specific employees.
- Government visibility: intelligence that private firms cannot access, which the FBI draws on when it issues a public attribution.
The limits of attribution
Attribution is an analytic judgment, not a courtroom verdict. Sophisticated actors can imitate another group’s tools, and the public seldom sees the underlying intelligence. The FBI’s statement on Bybit carries more weight than any single vendor’s blog post, but it is still an assessment. The sensible reading is a very high probability, not certainty. Where multiple independent analysts and a government agency converge, as in this case, the confidence is warranted.
How the Bybit-style attack worked
The Bybit theft was not a break of the Ethereum network or of cryptography. It exploited the human and software layers around a secure design. According to published investigations, attackers compromised a developer environment at Safe{Wallet}, a multisignature wallet provider, and injected malicious code into the interface that Bybit’s signers used. The signers believed they were approving a routine transfer between the exchange’s own wallets. The transaction they signed handed control of the funds to the attackers.
This matters because multisignature approval and offline storage were designed to stop exactly this kind of loss. The weak point was the gap between what the interface showed and what the transaction actually did. It is a textbook supply chain attack, combined with the kind of social engineering that Lazarus operators used in the Ronin case, where a fake job offer compromised an engineer.
Why North Korea hacks crypto exchanges
The motive is structural. North Korea faces extensive international sanctions that restrict its access to hard currency. Crypto theft offers a way around them. It needs no shipping, no banks and no cooperative trading partner, and the payoff per operation can exceed what many legitimate exports earn.
United Nations monitors and US officials have said for years that stolen digital assets help fund the country’s weapons programs. The exact share is hard to verify, because Pyongyang’s finances are opaque and the figures come from estimates. The UN Panel of Experts that documented much of this activity ended in 2024 after Russia vetoed its mandate renewal. That left a gap in independent public reporting, which private blockchain analysts and national governments now partly fill.
The economics favor persistence. The risk of arrest is close to zero, since the operators sit inside a state that does not extradite. The attacker bears the cost of failure only in time, while a single success can fund years of operations.
How does North Korea launder stolen cryptocurrency?
Theft is only half the operation. Converting a billion dollars of crypto into usable money without being frozen is the harder half. Analysts describe a consistent playbook:
- Rapid fragmentation: funds are split across many addresses within hours.
- Asset conversion: tokens that issuers can freeze are swapped for assets that are harder to block, often into Bitcoin.
- Chain hopping: cross-chain bridges and decentralized finance protocols break the transaction trail.
- Obfuscation: mixing services, or cryptocurrency tumblers, add noise.
- Cash-out: over-the-counter brokers convert the remainder into fiat, a final step that weak know-your-customer checks make possible.
Counter-efforts exist. Bybit set up a public bounty program to help trace and freeze funds, and some stablecoin issuers and exchanges froze portions of the proceeds. But recovery rates are low, because speed favors the thief. Public figures on how much was ultimately recovered vary by source and change over time, so any exact number should be treated cautiously.
Crypto exchange security: what operators must change
The lesson from the Bybit case is that crypto exchange security cannot stop at cold storage and multisignature wallets. The threat model has to include trusted third-party software and the people who operate it.
Priorities with real impact
- Verify what is being signed. Use independent transaction simulation and hardware displays that show decoded transaction data, not just the vendor’s web interface.
- Treat wallet-software vendors as critical suppliers. Demand audit evidence, code-signing controls and incident-notification terms.
- Segment signing environments. Dedicated, locked-down machines for signers reduce the damage a single compromised endpoint can cause.
- Harden the hiring and contact surface. Fake recruiters, fake investors and poisoned code samples are standard entry points, so staff with privileged access need specific training.
- Plan for the first hours. Pre-agreed contacts at stablecoin issuers, major exchanges and analytics firms improve the odds of freezing funds.
Common mistakes
Many firms still assume a successful audit of their own contracts means safety. They also overinvest in perimeter defenses while leaving developer workstations and deployment pipelines loosely controlled. Another frequent error is treating cold storage as a complete answer when hot-to-cold transfer processes remain exposed to manipulation.
Frequently asked questions
Did North Korea hack Binance?
There is no public attribution of Binance’s 2019 breach to North Korea. The record heist the FBI linked to the country was the February 2025 attack on Bybit. Binance does operate in the same ecosystem that stolen funds move through, so it is regularly part of the wider tracing and freezing effort.
Why is North Korea hacking crypto exchanges?
Sanctions limit its access to foreign currency, and crypto theft is a low-risk, high-return substitute. US officials and UN monitors have assessed that proceeds help fund weapons programs.
Is the Lazarus Group the same as North Korean hackers?
Lazarus is the best-known name for a cluster of state-linked operators. Analysts divide it into sub-groups, so it is shorthand rather than a precise organizational chart.
Can stolen crypto be recovered?
Sometimes, but only partly. Quick freezes by exchanges and token issuers can recover a portion. Once funds pass through bridges, mixers and brokers, recovery becomes difficult.
The uncomfortable lesson of the Bybit heist
The most important insight is that the attackers did not beat the cryptography. They beat the workflow around it. As long as the industry measures security by the strength of its wallets rather than by the integrity of every tool and person that touches a transaction, state-backed operators will keep finding the gap between what is shown and what is signed.
Three things are worth watching. First, whether regulators in the US, UK, EU and Asia begin treating wallet-infrastructure vendors as critical third parties, with matching security obligations. Second, whether sanctions enforcement reaches the over-the-counter brokers and bridges that complete the laundering chain, since that is where the operation is most exposed. Third, whether the end of the UN Panel of Experts weakens the public evidence base on which attribution depends.
A reasonable prediction, which is an inference and not a certainty, is that the next large theft will again target a trusted software or human dependency, not a protocol flaw. The unanswered question is whether the industry will harden those dependencies before the next record is set.