An official attribution, and a swift denial
On October 31, 2026, the FBI attributed the theft of about $6.3 billion from Binance, carried out on October 29, to North Korean actors. The bureau named the cluster it tracks as TraderTraitor, a set of activities also associated with the Lazarus Group and North Korean military intelligence. Pyongyang answered through the official KCNA agency: Kim Yo-jong rejected the accusation and called it a political provocation. North Korea had already denied responsibility for WannaCry and for the Bangladesh Bank theft.
Behind the Lazarus label, U.S. authorities and cybersecurity firms describe a structured apparatus tied to the Reconnaissance General Bureau (RGB). Units such as Bureau 121, and the cluster tracked as APT38, appear often in these reports. According to those sources, the group is trained and deployed in a methodical way.
Twelve years of operations, from reprisal to plunder
In 2014, the Sony Pictures breach followed the release of The Interview, a film that mocked North Korea's leader. Computers were widely disabled and internal emails leaked. U.S. authorities attributed the operation to North Korea and described it as retaliation.
In 2016, Bangladesh Bank was targeted through the SWIFT network. According to the U.S. Department of Justice, the operators tried to move nearly $1 billion; about $81 million actually left the bank. In 2017, the WannaCry ransomware outbreak hit 150 countries and hundreds of thousands of computers. The United States and the United Kingdom attributed that campaign to North Korea.
Crypto infrastructure then became a central target. In 2022, the Ronin bridge used by the game Axie Infinity was drained of about $625 million, a theft the FBI attributed to Lazarus. In February 2025, Bybit lost about $1.5 billion: the FBI again named TraderTraitor, and the sum set a record at the time. In April 2026, KelpDAO lost about $290 million; LayerZero, Mandiant, CrowdStrike and Chainalysis attributed the attack to TraderTraitor. In October 2026, the Binance theft, at about $6.3 billion, far exceeded that previous record.
The timeline shows a shift in purpose: first destabilization, then increasingly large-scale theft. According to TRM Labs, as of October 29, 2026, the cumulative value of cryptocurrency thefts attributed to North Korea since 2017 stands at $12.8 billion. That sum would, on some unofficial calculations, amount to nearly 45% of one year of the country's output. The comparison remains fragile, because it sets a multi-year stock of thefts against an annual GDP figure. In its review of 2025, Chainalysis recorded fewer confirmed attacks, a record haul, and a little more than 60% of North Korea-linked laundering volume moved in transfers below $500,000.
A recruitment pipeline described as a production line
According to defector accounts and public investigations, selection is said to begin around ages 11 to 13, among students flagged for mathematics and logic, with political loyalty as a filter. The institutions most often cited include Kim Chaek University of Technology, Kim Il-sung University, and Mirim University, frequently described as a training ground. Witnesses describe extremely stiff competition for a limited number of places.
Some of those selected would then be assigned to cyber units. Others would work on technical projects that remain inside the country, a point that has not been independently confirmed. Operators are also reportedly sent abroad, under the cover of front companies, to train on the open internet. The 2018 U.S. criminal complaint against Park Jin Hyok, described as a Kim Chaek graduate, accuses him of taking part in the Sony Pictures and WannaCry operations. Those charges have not been tested at trial, because he has not been arrested.
Several sources describe extremely long working days, on the order of 15 to 20 hours, in a militarized setting with little personal autonomy. These details rest largely on testimony and investigative reports, not on an independent inspection of the training system.
Fake IT workers and laptop farms
U.S. authorities have also documented another lever: North Korean IT workers apply for remote jobs at Western companies under false identities. To bypass location checks, local facilitators host laptops issued by the employers. The setup is often called a laptop farm.
Christina Marie Chapman was sentenced on July 24, 2025, to 102 months in prison, or eight and a half years, for her role in such a scheme, according to the Justice Department. The case helped workers obtain positions at more than 300 U.S. companies.
On October 13, 2026, the same department announced coordinated actions. In Operation Lonestar Roundup, the FBI searched more than 40 residences in Texas suspected of hosting such farms and seized about 187 devices. In a separate indictment filed in Ohio, 14 people were charged. Authorities say these schemes are designed to raise revenue for the regime, and that some workers have also exfiltrated employer data.
Most of their wages, sometimes put at around 90 to 95%, would be remitted to the regime. Families left at home would serve as leverage, and those selected would be given more comfortable housing in Pyongyang, with wider access to information. These details rest on testimony and have not been verified case by case.
Four strands of evidence, and their limits
The public attribution would rest on a bundle of indicators rather than on a single isolated proof. The first is the trail of the funds: on-chain investigators said the money leaving Binance later converged, after several hops, on wallet clusters already tied to earlier thefts attributed to North Korean actors.
The second is the method. The preparation of the attack and the targeting of internal operators' computers have been compared with earlier cases. In the Binance incident, public accounts also pointed to access obtained through an engineer's machine.
The third is the speed of dispersion. To limit stablecoin freezes, the funds were moved across a large number of wallets and several chains. They would also have used instant swaps and loans backed by collateral, a precise method that has not been confirmed by the public sources checked here. The FBI published more than 600 addresses: 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address, according to the count reported in the press. Chainalysis said it expected that number to grow into the thousands, or even tens of thousands. According to TRM Labs, stablecoin issuers and the Arbitrum Security Council froze nearly $2.7 billion.
The fourth strand is off-chain intelligence, whose details are not public. To illustrate the kind of traces sometimes placed on the record, the 2018 complaint against Park Jin Hyok cites identifiers that repeat the string "tty", and alleged logins from North Korean IP addresses into Sony's network. This chain of indicators would now be the most complete one available to the public, even if each link cannot be checked from the outside.
Why the core operators remain out of reach
The people described as the operational core have not been arrested. They are in North Korea, which has no extradition treaty with the United States. Arrest warrants function mainly as a public naming. The arrests that do occur mainly involve overseas facilitators, including people who run laptop farms.
What this means for the industry
The theft of about $6.3 billion appears as a major shock for the industry, and exposes a gap between how fast funds can move and the security level of many platforms. Artificial intelligence could further automate and accelerate such attacks.
The rules recalled to users remain simple: do not click unknown links, protect your private keys, and treat your own security as a priority. Each person remains responsible for their own judgment and decisions.