North Korea: Binance hacked for $6.3 billion – this money could fund nuclear weapons

Binance lost $6.3 billion in an attack, North Korean hackers are suspected

Cryptocurrency exchange Binance has reported a major hack that resulted in the theft of about $6.3 billion. According to preliminary data, the incident may have occurred due to the compromise of one employee’s laptop, which allowed attackers to submit unauthorized withdrawal requests. The exchange has already frozen about $3 billion and assured users that it will cover all losses. If this amount is confirmed, the incident will become the largest cryptocurrency theft in history.

Analytical firms, including TRM Labs and Chainalysis, point to the involvement of hacker groups linked to North Korea. This suspicion is based on similarities in the methods, speed, and scale of the operation compared with previous attacks attributed to North Korean groups.

How North Korean hackers fund the regime and nuclear programs

North Korea has long used cybercrime as a source of funding for the state. According to a report by the U.S. think tank CSIS, stolen funds are directed toward the development of nuclear and missile programs, evasion of international sanctions, and support for the regime. Some of the money also goes to sustaining the hacker groups themselves.

North Korea’s military cyber operations are centralized and subordinate to the top political leadership. The Reconnaissance General Bureau (RGB), also known as Unit 586, created in 2009, is responsible for financial cyberattacks and hacks of cryptocurrency platforms. Under its structure operate groups such as Lazarus Group and APT38, which stand behind some of the largest cyber heists, including the Ronin Network hack. Another unit, Unit 180, specializes in attacks against foreign financial institutions.

Money laundering and the working scheme of North Korean hackers

Since 2017, North Korea has been actively stealing cryptocurrencies, with total losses from such attacks estimated at at least $5.8 billion. Among the most high-profile hacks was the attack on the Bybit exchange in February 2025, when nearly $1.5 billion in Ethereum tokens was stolen. North Korean cyber units most often target Ethereum, Bitcoin, USDC, and Solana, hacking exchanges (Bybit, Upbit, Youbit), cross-chain bridges (Ronin Bridge), or token projects.

Kim Jong Un has doubled the size of the cyber units to 6,000–6,800 personnel, including about 1,700 professional hackers. To carry out attacks, North Korean hackers often recruit remote IT workers operating from third countries, including China, Russia, the UAE, Cambodia, and Tanzania. They create so-called “laptop farms,” using equipment provided by foreign employers to steal funds, data, or create backdoors for future attacks. According to CSIS estimates, these networks generate between $350 million and $800 million annually.

Stolen funds are laundered through repeated transfers across thousands of intermediary addresses, the use of decentralized mixers, and cross-blockchain transactions. Cash is often withdrawn through centralized exchanges with the help of underground brokers or services in third countries.