North Korea Behind $5.9 Billion Binance Heist: FBI's Eight-Year Manhunt for Park Jin

North Korea's hacking organizations have been named as the force behind the theft of roughly 8 trillion won (approximately $5.9 billion) in assets from Binance, the world's largest cryptocurrency exchange, bringing renewed attention to Park Jin-hyuk—a North Korean hacker the U.S. Federal Bureau of Investigation (FBI) has sought for eight years. His identity and face have been made public, but authorities have still failed to take him into custody.

In a cybersecurity alert issued on the 31st of last month, the FBI attributed the theft of more than $6 billion (~8.1 trillion won) in crypto assets from Binance to North Korea. The hacking campaign identified by investigators is known as "TraderTraitor," a group linked to Lazarus, North Korea's flagship hacking organization. The FBI did not state, however, that Park personally participated in the Binance incident.

Park is drawing renewed scrutiny because he is suspected of involvement in Lazarus-linked cyberattacks. According to the FBI website, he has been on its cybercrime wanted list since 2018. In September 2018, the U.S. Department of Justice disclosed his identity and indicted him on charges tied to the 2014 Sony Pictures hack, the 2016 theft from the Bangladesh central bank, and the 2017 WannaCry ransomware attack.

The most prominent case is the Sony Pictures attack. In 2014, ahead of the release of "The Interview," a film centered on a plot to assassinate North Korean leader Kim Jong-un, hackers breached the studio's internal networks, leaking unreleased films and employees' personal data and destroying systems. U.S. investigators concluded that North Korea carried out the attack in retaliation over the film's production.

In the 2016 Bangladesh central bank case, hackers exploited the SWIFT international bank messaging system to send fraudulent transfer orders to the Federal Reserve Bank of New York. They initially sought to steal $1 billion (~1.3 trillion won), but some transactions were blocked, limiting actual losses to $81 million (~110 billion won). Park is also suspected of involvement in the WannaCry ransomware attack the following year, which hit hospitals, companies, and public institutions worldwide, including medical facilities under Britain's National Health Service (NHS).

An attempted intrusion targeting U.S. defense contractor Lockheed Martin was also part of the investigation. In 2016–2017, Park and other North Korean hackers sent malicious emails in a bid to penetrate the company's networks, and some messages contained material related to the THAAD missile defense system deployed to U.S. Forces Korea. The Justice Department said, however, that the attempt did not result in an actual breach.

In February 2021, the Justice Department also unsealed a superseding indictment against three North Korean hackers—Park Jin-hyuk, Jon Chang-hyok, and Kim Il. They are accused of stealing or extorting more than $1.3 billion (~1.8 trillion won) in cash and crypto assets from financial institutions and companies worldwide. The charges also include creating and distributing malicious cryptocurrency trading programs.

According to FBI public records, Park studied at Kim Chaek University of Technology in North Korea and later worked as a programmer at Chosun Expo Joint Venture, a software development company. The U.S. government concluded that the company ostensibly ran a software development business but was in fact a front supporting cyber operations for North Korea's Reconnaissance General Bureau. Investigators found he also worked as an employee of the same company in Dalian, in China's Liaoning Province.

The wanted materials describe a man with black hair and brown eyes who speaks Korean, English, and Chinese. His birth year is listed as either 1981 or 1984, and records show he has used the alias "Pak Kwang-jin." The first U.S. federal arrest warrant was issued on June 8, 2018, and an additional warrant followed in December 2020 on charges of bank fraud and conspiracy to commit computer intrusion. The FBI said he was born in North Korea, has a history of past travel to China, and was last known to be located in North Korea. The Australian government also placed him under financial sanctions and banned him from entering the country last November.

North Korea has consistently denied the U.S. findings. In 2018, a North Korean Foreign Ministry official called Park "a person who does not exist" and condemned the indictment. Pyongyang has also flatly denied any involvement in the recent Binance hack. Kim Yo-jong, deputy department director of North Korea's Workers' Party, said on the 3rd that the United States is forcibly linking North Korea to cybercrimes occurring around the world.

U.S. investigators believe North Korea's hacking organizations are attempting to launder the stolen crypto assets by converting them into other cryptocurrencies. The FBI is tracking the movement of the funds while asking private crypto firms to block suspicious transactions. The case illustrates that North Korea-originated cyber threats have become a structural risk for the crypto market. For exchanges, a hack can quickly erode trust and drive away customers, making security investment and cooperation on fund tracing unavoidable, analysts say, while investors need to reassess how major exchanges safeguard assets and respond to incidents.