North Korea has been pointed to as the mastermind behind an 8 trillion-won hacking incident at Binance, the world's largest cryptocurrency exchange, bringing renewed attention to the hacking industry that has firmly established itself as a major source of foreign currency for the regime.
Global media outlets pointed out that North Korea, isolated by international sanctions, is intensively training hackers and stealing cryptocurrency to secure funds necessary to maintain its regime.
According to blockchain analytics firm Chainalysis on the 30th (local time), the cryptocurrency estimated to have been stolen by North Korean hackers last year was approximately $2 billion (about 2.9 trillion won), accounting for about 60 percent of total global cryptocurrency thefts.
The damage from the latest Binance hack is estimated at a record-high $6.3 billion (about 8.4 trillion won), an amount equivalent to roughly one-fifth of North Korea's gross national income (GNI).
Such cryptocurrency theft attacks have continued steadily since the late 2010s.
According to a UN Security Council Panel of Experts report reviewed by the UK's Guardian, cryptocurrency firm attacks presumed to be the work of North Korea totaled 58 cases between 2017 and 2023, with damages amounting to about $3 billion.
The Panel of Experts estimated that funds stolen through hacking account for half of North Korea's foreign currency revenue.
Estimates have also emerged that funds stolen by North Korea cover about 40 percent of the costs for its weapons development programs.
In effect, cryptocurrency theft through hacking has become a key "strategic industry" for North Korea.
North Korea has continued making massive investments in cyber warfare alongside its nuclear program, and has reportedly established a specialized talent training system.
The method involves selecting students showing talent in mathematics and science from a young age, putting them through 3 to 5 years of cyber warfare training, and then advancing top performers to specialized university courses.
In fact, the Committee for Human Rights in North Korea stated in a report this year that Pyongyang's Moranbong University runs a five-year curriculum combining military science with hacking and cryptography.
Some elite operatives are also known to receive additional training in China and Russia.
Furthermore, because their activities are state-sanctioned, experts pointed out that they can act more boldly than hackers from other regions without fearing criminal prosecution at home.
Shin Beom-chul, former vice minister of national defense, told the Financial Times (FT) that "North Korean hackers are the world's most aggressive and skilled cyber actors," adding that "they undergo systematic training and are deployed to earn foreign currency for the regime."
North Korea's illegal "foreign currency earnings" also have a long history.
North Korea produced sophisticated $100 counterfeit bills known as "supernotes" in the 1990s, and was suspected of engaging in the manufacture and trafficking of narcotics such as methamphetamine in the 2000s.
Having since turned its sights to cybercrime, North Korea gained global notoriety with the 2014 Sony Pictures hacking incident.
This incident was perceived as retaliation for Sony Pictures pushing forward with the release of a comedy film depicting a plot to assassinate North Korean leader Kim Jong-un.
In 2022, the North Korean hacking group Lazarus was blamed for stealing about $620 million (approx. 800 billion won) from the blockchain-based gaming network Ronin Network, and in 2024, "TraderTraitor," known as an organization under Lazarus, stole $308 million (approx. 400 billion won) from the Japanese cryptocurrency exchange DMM Bitcoin.
TraderTraitor was also found to have stolen $1.5 billion (approx. 2 trillion won)—the largest scale at the time—from the Bybit exchange in February of last year.
Warnings are also emerging that the advancement of artificial intelligence (AI) will further amplify North Korea's hacking threats moving forward.
Simon Choi, Chief Technology Officer (CTO) at cybersecurity firm Stealthmole, said AI is helping hackers discover security vulnerabilities and automate attacks, noting that "AI has given wings to hackers."
※
Copying, redistribution, and unauthorized use in AI training are strictly prohibited.