Cyber Awareness

North Korea’s Crypto Heists Drive 40% of Its WMD Funding, UN Panel Finds

By Dan Sabbagh

North Korea, largely isolated from the global economy, has turned to sophisticated hacking to generate foreign earnings. Experts from TRM Labs linked the $6.3 billion (£4.7 billion) theft from Binance to TraderTraitor, an elite North Korean hacking unit also known as the Lazarus Group. The unit has a history of cryptocurrency thefts dating back to 2017, targeting the sector’s weaker security controls to fund its military, including its nuclear weapons programme.

Kim Jong‑un’s regime maintains a stockpile of about 50 nuclear warheads and supplies troops and weapons to Russia in its war in Ukraine. Despite this, the country remains extremely poor, with 40 % of its population undernourished and nearly one in five children stunted, according to the UN.

A UN panel of experts, reporting to the Security Council, said in spring 2024 it was reviewing 58 suspected cyber‑attacks by North Korea on cryptocurrency‑related companies between 2017 and 2023, worth $3 billion. The panel estimated that the cash generated from these attacks accounts for half of North Korea’s foreign‑currency income. One unnamed country further estimated that the stolen billions fund 40 % of the weapons‑of‑mass‑destruction programmes.

In 2023 alone, North Korea was suspected of 17 crypto hacks, with thefts totaling $750 million, and the sums involved are increasing. The world’s largest previous crypto hack occurred in February 2025, when $1.5 billion was stolen from the Bybit exchange, an operation attributed by the FBI to TraderTraitor.

Ciaran Martin, former head of the UK’s National Cyber Security Centre, argues that North Korea targets crypto because traditional banks have developed sophisticated defences that the fast‑growing, lightly regulated sector has yet to match. “Over the last decade, hackers have walked off with nine‑ or 10‑figure sums from crypto hacks on more than 30 occasions. The number of traditional banks that have suffered a loss of more than $100 million as a result of a cyber‑attack in the same period is zero or one,” Martin said.

North Korea was also behind the 2016 Bangladesh Bank heist, in which hackers attempted to move $951 million from an account the bank had with the Federal Reserve Bank of New York. A combination of timing differences and transfer delays prevented most of the money from being sent to an intermediate account in the Philippines, and $81 million was ultimately stolen.

The isolated state has long been accused of engaging in criminal activities to survive, including the forgery of high‑quality $100 bills in the 1990s and the production and trafficking of crystal meth in the 2000s. In 2019, North Korean hackers tried to take control of cash machines linked to 56 financial institutions in the UK, but the attack was quietly suppressed after British officials alerted the banks.

Internet access is severely restricted in North Korea, but the state recruits some of its best students into hacker groups such as Lazarus, operating under the Reconnaissance General Bureau spy agency. The group’s 2014 hack of Sony Pictures, which leaked thousands of embarrassing emails, was carried out in retaliation for the studio’s funding of the film "The Interview," a comedy depicting the assassination of Kim Jong‑un. The incident forced Sony to cancel the film, then ultimately release it online and in a limited number of cinemas after criticism of its capitulation to North Korean pressure.