FBI says North Korean hackers are behind the theft of $6.3B from Binance

Embed

The FBI is attributing the theft of $6.3 billion from the Binance cryptocurrency exchange to North Korean hackers. North Korea has prioritized cyber operations and built a formidable cyber force.

Trading resumes Sunday on Binance, the world's largest cryptocurrency exchange. Some transactions were halted on Thursday after hackers stole some $6.3 billion in cryptocurrencies, the largest such theft on record. The FBI says North Korea is behind the hack. NPR's Anthony Kuhn joins us from Seoul to North Korea's rise as a cyber power. Anthony, so what's the evidence that North Korea is behind the heist?

ANTHONY KUHN, BYLINE: North Korea itself has neither confirmed nor denied responsibility for the job, A. They have in past denied responsibility for similar hacks. But researchers and law enforcers associate some of the methods used in this hack with North Korean actors. Binance, for example, says hackers may have been able to get access to a Binance engineer's laptop, which then allowed them to submit unauthorized withdrawal transactions. That looked familiar. Another sign is that crypto transactions are recorded on public ledgers on blockchains, and researchers and law enforcement can watch those transactions in real time, and they say they traced transactions to accounts that they said were linked to North Korea.

MARTÍNEZ: So, Anthony, was this a complete success for the hackers?

KUHN: Apparently not. I spoke to Ari Redbord, the head of global policy for TRM Labs, a firm that monitors the blockchains. And he told me that crypto firms were able to freeze more than 40% of the stolen assets, so hackers couldn't cash them out.

ARI REDBORD: I think the 2.0 version of this story is we had the largest hack, largest, you know, theft in human history. We had an incredible job of the ecosystem coming together to freeze assets. But now North Korea's going to try to launder the rest and convert whatever it can.

KUHN: In other words, at the same time as the hackers are improving their offensive capabilities, the crypto industry is also stepping up its defenses.

MARTÍNEZ: What the identity of the alleged North Korean hackers?

KUHN: The FBI attributes the hack to a hacker group called TraderTraitor. That's an arm of a larger unit called the Lazarus Group, which is under North Korean military intelligence. Now, military intelligence oversees North Korea's cyber warfare operations, which include sabotage, spying and moneymaking. And of these, moneymaking is believed to have risen to be their top priority.

According to a United Nations Security Council Panel of Experts report, cyber theft now provides half of North Korea's foreign currency earnings. And it funds 40% of its weapons of mass destruction. And the cyber units are also involved in everything from psychological warfare and ransomware to getting its agents hired as remote IT workers at foreign companies.

MARTÍNEZ: Now, how can a country like North Korea that's isolated, in which most people have no internet access, become such a cyber power?

KUHN: Well, for years, North Korea has prioritized cyber operations because they see them as cheap and covert and deniable. In other words, it means a cyberattack is probably not going to trigger a war. They also see cyberweapons as versatile tools for advancing the state's key aims, which include keeping the family of leader Kim Jong Un in power and building their nuclear arsenal and also evading sanctions. South Korea's spy agency estimates that as of 2024, North Korea had over 8,400 trained cyber warfare agents, with thousands more involved in training and other support roles both inside North Korea and overseas. And they select operatives for training from a very young age. And these operatives enjoy better pay and elite status compared to other personnel.

MARTÍNEZ: All right. That's NPR's Anthony Kuhn joining us from Seoul. Thanks a lot, Anthony.

(SOUNDBITE OF FRENIC SONG, "DEATHLESS AUDIO")

Accuracy and availability of transcripts for NPR programming may vary. Transcript text may also be revised to correct errors or match updates to audio. Audio may be edited after its original broadcast or publication. The authoritative record of NPR’s programming is the audio record. Please note that NPR platforms and products also include some programming produced by third parties; NPR cannot guarantee transcripts for that content and some transcripts may be produced using automated or other tools.

NPR does not offer or accept money for coverage or interviews. Anyone who makes such an offer or request is not an NPR employee and does not represent NPR.

Support mission-driven journalism while getting something great in return. Enjoy bonus content, early access and sponsor-free listening from your favorite NPR podcasts.

Already have NPR+? Sign In