Stealing $11.8 Billion in a Decade: How North Korea Became the Crypto World's Top Predator

Written by Xiaobing, TechFlow

In the early hours of October 30, 2026, hot wallets on nine Binance chains were breached simultaneously, with more than $6.26 billion moved out on-chain.

On October 31, the U.S. Federal Bureau of Investigation (FBI) announced that North Korean hacker groups were involved in the Binance theft. Trump said that if North Korea were confirmed responsible, the United States would engage with North Korea.

A country has turned the entire crypto industry into an ATM.

According to TechFlow's count, between 2017 and 2026, hackers linked to Lazarus and North Korea were involved in a total of 37 crypto theft cases, with a combined estimated value of about $11.817 billion.

From a 2017 attack on South Korean exchange Bithumb that stole $7 million, to Binance losing billions overnight, how did North Korea—widely considered to be closed off online—go from a marginal player in cyber warfare to the crypto world's top predator in under a decade?

One PDF, $600 Million

In early 2022, a senior engineer at Sky Mavis, the parent company of crypto game Axie Infinity, received a LinkedIn message. The sender claimed to be a recruiter at a company and pitched an extremely attractive compensation package.

The engineer went through multiple interview rounds, and everything looked legitimate. In the end, he received an offer letter in PDF format. The moment he opened the file, spyware silently slipped into Sky Mavis's internal systems.

Axie Infinity's Ronin Bridge uses a Proof of Authority mechanism with nine validator nodes, requiring signatures from five nodes to approve withdrawals. The attackers penetrated Sky Mavis's IT infrastructure through the infected engineer's computer and obtained the keys for four validators. The fifth signature came from a forgotten flaw: in November 2021, Sky Mavis had asked Axie DAO to help sign during peak transaction loads. That temporary authorization had been disabled in December, but access was never revoked.

In March 2022, $620 million vanished from Ronin Bridge. A month later, the FBI attributed the attack to North Korea's Lazarus Group.

A fake offer, a forgotten authorization, and $600 million stolen.

The Ronin playbook was repeated again and again afterward, but the attackers' tactics evolved.

In June 2022, Harmony Horizon Bridge fell, and $100 million was moved out. The attackers posed as blockchain developers and obtained system access as insiders. In 2023, Atomic Wallet, Alphapo, CoinsPaid, and Stake.com fell in succession, with combined losses exceeding $238 million. By July 2024, Indian exchange WazirX had been breached for $235 million.

Each attack used different tactics, but the underlying logic was strikingly consistent: find a person, deceive that person, and use that person to open a door.

In February 2025, they took this methodology to a new level.

$1.5 billion was moved out of Bybit's cold wallet. Paradigm security researcher samczsun's postmortem showed that the attackers did not attack Bybit directly. Instead, they penetrated the infrastructure of its multisig wallet provider Safe{Wallet}, planted malicious code there, and precisely targeted Bybit's cold-wallet signing process. This meant that even if Bybit's own security measures were flawless, once the upstream supply chain was compromised, every defense became meaningless.

Eight months later, Binance became the latest prey.

Binance's post-incident investigation found that an operations engineer's laptop had been compromised, and the attackers used it to penetrate internal systems and exploit EIP-7702 to make hot wallets sign a delegation authorization. In an on-chain postmortem, Shenyu broke down the logic of the attack contract: "The attacker's program recognizes only one master and does only one thing: move money."

From Ronin to Bybit to Binance, the scale jumped from $600 million to $1.5 billion, and then to $6.2 billion. Every one was a triumph of social engineering, and every one started with a single person.

Your Coworker Might Be North Korean

If Lazarus's external attacks are "breaking down the door," then the infiltration by North Korean IT workers is "walking in through the front door."

In October 2024, CoinDesk published an investigation that shocked the industry. By tracing blockchain payment records and internal leads, reporters found that more than 24 crypto companies had unknowingly hired North Korean IT workers, with at least 12 companies confirming they had identified suspected North Korean nationals on their staff lists. Projects named included Cosmos Hub, Injective, ZeroLend, Fantom, Sushi, Yearn Finance, and Truflation.

MetaMask security researcher Taylor Monahan revealed that at least 40 DeFi protocols had employed North Korean IT workers over the course of their development, spanning as long as seven years.

These people cleared screening with forged passports, visas, and carefully fabricated résumés, submitting applications on Telegram, Discord, and Indeed. They targeted startup teams with loose hiring processes that paid salaries in crypto, and almost never turned on their cameras while working remotely. According to UN estimates, North Korean IT workers earn up to $600 million a year for the regime, of which individuals get to keep only 10% to 30%.

In March 2024, the Munchables incident provided a textbook case.

The NFT game on the Blast chain hired a developer using the pseudonym "Werewolves0943." On-chain investigator ZachXBT traced the developer and found that he was a North Korean spy who used his developer access to drain 17,400 ETH from the project, worth about $62 million.

The twist is that, under pressure from multiple parties including Blast founder Pacman and the community, the developer handed over all private keys within eight hours and returned all the stolen funds in full. No one knows why he returned them. One theory is that after being exposed, continuing to hold the stolen funds would only invite bigger trouble.

But Sushi's experience was not so fortunate.

In September 2021, about $3 million was stolen from the Sushi/MISO platform. A subsequent investigation found that two former contractors using the pseudonyms "Anthony Keller" and "Sava Grujic" retained access to the code repository after being fired. Sushi later hired another suspected North Korean contractor, "Gary Lee." In 2023, Truflation founder Stefan Rust found five suspected North Korean workers on his team, more than one-third of all employees. The company then suffered a private-key leak attack of about $5 million.

CrowdStrike data shows that North Korean IT workers infiltrated more than 320 companies within 12 months, up about 220% year over year.

They use false identities, hire people in the United States to set up multiple computers for centralized remote work in order to fake their locations, and use generative AI to handle video interviews.

Security company KnowBe4 even found that it had been fooled: an "employee" hired through its normal recruitment process began deploying malware immediately after starting work.

Can't Say a Bad Word About Kim Jong Un

What kind of people are North Korean hackers, really?

In August 2026, a Korean-American journalist, with assistance from MetaMask security researcher Taylor Monahan, SEAL Alliance's Nick Bax, and Ump Labs, posed as a recruiter named "Sophie Wang" and conducted a video interview with a suspected North Korean state-level hacker.

The applicant called himself "Justin Lim" and claimed to live in Long Beach, California, but his accent was judged to be South Korean. On-chain clues and identity data indicated that his actual location was most likely Vladivostok, Russia, and that he had stolen about $2.7 million from MetaPlay in 2022.

During the interview, he demonstrated considerable technical ability: he described how to fork the Velas network and get The Graph running compatibly, and when encountering protocols he did not know well, OpenSea Seaport and Uniswap v4, he pulled up the documentation on the spot to analyze them.

When the interviewer mentioned that North Korea had stolen $1.5 billion from Bybit, he smiled for the only time in the entire interview.

The last question ended everything. The interviewer asked him to say something negative about Kim Jong Un. After a silence, he left the Zoom call. He then cited "unstable internet" and asked to continue the conversation on Discord or Telegram. When pressed again, he replied only: "I don't know much about this person."

In North Korea, publicly criticizing the supreme leader can result in three generations of a family being sent to political prison camps. This test was later widely recommended by the security community as a hiring screen: ask candidates to say something negative about Kim Jong Un, and almost all North Korean developers will avoid it.

Secret War

North Korea's cyberattack capabilities were not built overnight.

According to North Korean defector Jang Se-yul in disclosures to Business Insider, North Korea's cyberwar program dates back to the 1980s, under the internal codename "Secret War." The Kim regime recognized early that, given its conventional military forces were far inferior to the combined U.S.-South Korean forces, cyber operations were the lowest-cost, highest-return asymmetric weapon.

Training a North Korean hacker takes about nine years. The starting point is Kim Chaek University of Technology (formerly the University of Automation), which admits 100 students each year from about 5,000 applicants. The first screening criterion is political background; North Korea's songbun ("component") system divides citizens into three main classes and 56 subcategories, recorded in household registration files. Students take six 90-minute classes a day, studying programming languages and operating systems, diving deep into Windows architecture, and are required to write malware independently without relying on off-the-shelf tools.

After graduation, hackers are assigned to country-targeted operations units and spend about two years overseas undercover as employees of legitimate companies, learning the local language and culture. The pay is extremely generous: up to $2,000 a month, twice the salary of a North Korean ambassador. Rewards also include an apartment in Pyongyang of more than 185 square meters and the right to move the whole family to the capital.

"The cost of training a hacker is extremely low," Jang said. "That is why even a poor country can invest heavily in this field."

In his view, cyber threats are more direct and more dangerous than nuclear threats: "This is a war that does not require firing a gun."

Ghost Empire

In 2019, the U.S. Treasury sanctioned three entities—Lazarus Group, BlueNoroff, and Andariel—and noted that all were controlled by North Korea's Reconnaissance General Bureau (RGB). But "Lazarus" is merely an umbrella name used by outsiders for a vast state-level cyberattack apparatus.

In an analysis published after the Bybit incident, Paradigm security researcher samczsun mapped this tangled organizational network:

TraderTraitor: The big-ticket hunter. It specializes in exchanges, custodians, and wallet systems, and is adept at spear-phishing and fake job offers. Ronin, WazirX, and Bybit were all its work. It typically does not use zero-days; instead, it manipulates people to pry systems open.

AppleJeus (Citrine Sleet): The supply-chain assassin. It develops trojanized software for crypto use cases, and its 2024 infiltration of Radiant Capital is a signature operation. It also exploited the Chromium zero-day CVE-2024-7971 to deploy the FudModule Rootkit.

BlueNoroff (Sapphire Sleet): The financial hunter. It attacked banks and the SWIFT system early on and in 2016 nearly made off with $1 billion from Bangladesh's central bank (it actually got $81 million). It has now fully pivoted to crypto and VC.

Famous Chollima: The infiltrator. It uses false identities to get hired at tech and crypto companies, creating internal penetration capability. The 320 compromised companies tracked by CrowdStrike are largely its handiwork.

DangerousPassword: Low-cost, broad-net. Phishing emails and fake video-call apps; the tactics are simple, but they win through volume.

There is significant overlap in personnel, tools, and infrastructure among these branches, and different security agencies give them different names: Diamond Sleet, UNC4899, Contagious Interview, Wagemole.

One adversary, more than a dozen names, different masks.

Asymmetric War

After the Binance incident, Musk posted on X: "Everyday is Zeroday."

This is not rhetoric. A dedicated research report from Microsoft Threat Intelligence shows that of North Korea's eight major active hacking groups, three have deeply integrated AI tools into their day-to-day attack workflows, reaching the highest level in Microsoft's maturity model for AI use in cyber threats.

AI's involvement is no longer confined to peripheral experiments; it now covers the entire chain—from initial reconnaissance, social-engineering phishing, and identity masquerading to malware development and even software supply-chain poisoning. In other words, the phishing emails, fake résumés, and malicious code that once took weeks to prepare can now be generated in bulk and iterated automatically.

An attacker needs to find only one flaw; defenders must guard against them all. This is an asymmetric war.

From Bithumb's $7 million to Ronin's $620 million, from Bybit's $1.5 billion to Binance's $6.2 billion, the scale of the attacks has grown exponentially. At the other end of this curve is a country with a per capita GDP of under $2,000, a group of young people who began nine years of training at age 17, and a state machine that has served "Secret War" for four decades.

The crypto industry must face a fact: what stands on the other side is the full cyberwar power of a nuclear-armed state, and this adversary is becoming stronger and stronger.

Join the official Coincamps community:

X: https://x.com/coincamps

Telegram: https://t.me/coin_camps