COVER STORY North Korea has every incentive to keep stealing crypto, analysts say

The $6.36 billion cryptocurrency heist targeting Binance has exposed a troubling reality for the digital asset industry: North Korea is increasingly exploiting security vulnerabilities to bankroll Pyongyang's military ambitions.

The stolen amount is equivalent to 22 percent of North Korea's 2025 gross domestic product, making the attack the largest cryptocurrency theft on record and one of the biggest financial crimes in history.

Analysts warned Sunday that it is unlikely to be the last.

"We're dealing with sophisticated adversaries who may have substantial resources, years of patience and objectives that extend well beyond financial gain," said Michael O'Loughlin, managing partner of Argonautic Global and board member of Blockchain Ireland.

Proceeds from cryptocurrency theft have become an increasingly important source of funding for cash-strapped North Korea, alongside an estimated $22 billion in foreign income generated since 2022 through its support for Russia's war in Ukraine.

The stolen funds could help finance its nuclear and ballistic missile programs, as well as efforts to modernize its conventional forces. Even if roughly half of the stolen assets are ultimately recovered, Pyongyang could still walk away with billions of dollars in additional funding, according to Adam Farrar, senior geoeconomics analyst for Asia-Pacific at Bloomberg Economics.

These financial resources, combined with deepening ties with Moscow and renewed outreach from Beijing, also leave North Korean leader Kim Jong-un with fewer incentives to compromise on his nuclear program, he added.

"Pyongyang has every incentive to keep exploiting gaps in the crypto ecosystem to finance its military ambitions," Farrar said. "The Binance hack will certainly not be the last."

North Korea's expanding cyber arsenal

Suspected North Korea-linked cyberattacks account for nearly 89 percent of reported losses in cryptocurrency heists so far this year, compared with just 15 percent in 2021, according to blockchain intelligence firm Chainalysis. The average loss per suspected North Korea-linked cyberattack has nearly quadrupled, from $50.65 million in 2021 to $185.65 million this year.

The U.S. FBI and blockchain intelligence firms identified the figures of the Binance attack as TraderTraitor, an elite North Korean hacking group. The FBI also attributed the $1.5 billion Bybit heist in February 2025 to the same group.

U.S. President Donald Trump commented on the crypto heist on Saturday. "We're learning about it. We don't know if it's North Korea, but if it is, we'll talk to them about it," he told Fox Business.

North Korea has reportedly developed a systematic training program to cultivate a new generation of cyber operatives. Students who show an early aptitude for mathematics and science are selected for specialized cyberwarfare training lasting three to five years, with top performers advancing to elite university programs.

Industry officials warn that advances in artificial intelligence (AI) could make future attacks easier to carry out.

"What has changed is the sophistication of the attacks themselves. TRM analysts have begun to speculate that North Korean operators are incorporating AI tools ... which required weeks of targeted manipulation of complex blockchain mechanisms," blockchain intelligence firm TRM Labs wrote in April.

Test of trust for crypto industry

The Binance heist could make a growing number of traditional companies more wary of adopting blockchain technology, according to analysts, as the industry seeks to expand its role in conventional financial markets.

"These attacks damage public confidence because people don't distinguish between a failure of the technology and a failure of the institution protecting their money — nor should we expect them to," O'Loughlin said.

"North Korea's cyber operations demonstrate something important: You don't necessarily need to defeat a financial system to steal from it. Sometimes you only need to compromise one person with the right access. That's why cybersecurity cannot be treated as a technology problem alone. It's a question of people, governance and institutional resilience."

Korea is working on a comprehensive regulatory framework for digital assets, known as the Digital Asset Basic Act. The country has also been grappling with a string of cyberattacks targeting major companies, including Bithumb, its second-largest cryptocurrency exchange.

As cyberthreats grow more sophisticated, analysts say safeguarding the financial system will require not only stronger technological defenses but also closer cooperation among governments, financial institutions and technology providers.

"These cyberattacks are not just a 'crypto' problem; these are a global financial markets and security problem, affecting nearly all of us," said Sandra Ro, CEO of the Global Blockchain Business Council.

The recent Binance attack prompted the world's largest cryptocurrency exchange to suspend withdrawals and pledge to cover all losses. Binance said Saturday that it had replaced about 90 percent of the stolen amount using its own funds and planned to restore withdrawals by Sunday.