The largest crypto theft in history took about 15 minutes. The money pays for missiles, and some of North Korea's cash comes out of American payrolls.
By Brian Bullock
North Korea cannot feed its own people, but it runs one of the most profitable criminal operations on the planet. Its workforce is a few thousand hackers and fake remote employees. Its targets are banks, crypto exchanges and American companies that never knew they were dealing with Pyongyang. Last week it pulled off the biggest job in its history.
Fifteen Minutes
On Thursday, October 29, hackers took about $6.3 billion in digital coins from Binance, the world's largest crypto exchange. Binance co-CEO Richard Teng said the break-in appears to have started with one compromised laptop belonging to a company engineer. He said it was not a one-click job. Binance later found more points of entry and called it a complex hack.
Once inside, the attackers went after one of Binance's hot wallets, the online accounts an exchange keeps ready to pay out customer withdrawals. Using a feature built into Ethereum, they signed a permission that handed control of the wallet to their own software. From that moment, anything that landed in the wallet was forwarded straight to them.
The theft itself was fast. Ari Redbord of TRM Labs, a firm that tracks crypto crime, said the attacker moved billions across eight separate blockchains in about 15 minutes. Reuters put most of the theft at about 20 minutes. Investigators believe the hackers spent at least 36 hours inside the system getting ready.
TRM Labs, Chainalysis and Elliptic, three of the biggest tracking firms, all tied the theft to North Korea through links to its earlier hacks. On Saturday, the FBI made it official. Together with the Secret Service and IRS investigators, it named the North Korean state hacking group it calls TraderTraitor, also known as Lazarus Group.
How They Get In
North Korea rarely breaks through a wall of code. It usually gets one employee to open the door.
In 2022, a senior engineer at Sky Mavis, the company behind the Ronin gaming network, applied for a job at a company that did not exist. He went through several rounds of interviews and was offered a generous salary. The offer letter came as a document that carried hidden malware. That one download gave the hackers a path into Ronin's network, and they walked off with more than $600 million.
In February 2025 the target was Safe{Wallet}, a company whose software Bybit used to approve large transfers. A Safe developer downloaded a project made to look like a stock trading simulator. It opened a back door on his laptop. From there the hackers reached the company's cloud servers and planted code on its website. When Bybit's staff went to approve what looked like a routine transfer, they were signing away $1.5 billion, the record until last week.
Binance's own account of a single engineer's laptop fits the same pattern.
The Customers Caught in the Middle
Binance says it has more than 335 million users worldwide. For two days, none of them could take money out. Binance froze deposits and withdrawals while it worked out how deep the breach went.
The company promised its customers would not lose a cent. It pulled about $6 billion from its corporate treasury, an emergency insurance fund it set up in 2018, and reserves held for security breaches. By Sunday it said 95 percent of the losses had been covered. Balances in its 10 biggest coins, including Bitcoin, Ether and the major digital dollars, are fully backed again. The rest are smaller tokens the company is still buying back through trades and private deals.
Withdrawals reopened Sunday on 15 networks. In the first day, customers pulled out several billion dollars more than they put in, between 2 and 3 percent of the assets on the exchange. Analysts said that fell far short of a panic. More withdrawals are being switched back on in stages this week.
Security analysts are warning Binance users about the next wave. Big hacks bring scammers who pose as the exchange and offer fake refunds or account checks.
The damage spread past Binance. Bitcoin fell to a six-week low of about $76,400. Shares of Coinbase, Robinhood and Strategy, a company built around holding Bitcoin, each dropped more than 6 percent in early trading.
Binance is not a spotless victim. In 2023 it pleaded guilty to breaking federal anti-money-laundering laws and paid $4.3 billion. Its founder, Changpeng Zhao, served four months in prison before the President pardoned him.
A Twelve-Year Crime Spree
The same network has been doing this for more than a decade.
In 2014 it broke into Sony Pictures over The Interview, a comedy about killing Kim Jong Un, and dumped the studio's emails and unreleased films online. In 2016 it got into Bangladesh's central bank and sent fake transfer orders through the Federal Reserve Bank of New York. Eighty-one million dollars went out before anyone caught on. In 2017 its WannaCry ransomware locked computers in about 150 countries and forced British hospitals to turn patients away. The Justice Department charged a North Korean programmer, Park Jin Hyok, for all three in 2018. He has never seen an American courtroom.
Then the targets moved to crypto. The Ronin theft went unnoticed for about a week. Many of the game's players lived in the Philippines and other poor countries and had been playing it to earn a living. Sky Mavis had to raise $150 million from investors, with Binance leading the round, to pay its users back.
The Workers Inside American Companies
North Korea does not only steal from the outside. It also gets hired.
Thousands of North Korean tech workers apply for remote jobs at Western companies using stolen or bought identities. Americans help them by running what investigators call laptop farms. The company ships a work laptop to an address in the United States. Someone in that house keeps it plugged in, and a North Korean logs into it from overseas.
Christina Chapman of Litchfield Park, Arizona, ran one of these operations. Using 68 stolen American identities, she helped North Koreans get jobs at 309 American businesses. They included a top five television network, a Silicon Valley tech company, an aerospace manufacturer and an American car maker. The workers also tried to get inside two federal government agencies but were mostly turned away. Chapman forged payroll checks, took the wages by direct deposit and sent false paperwork to the Department of Homeland Security at least 100 times. She shipped 49 laptops overseas, some to a Chinese city on the North Korean border. Investigators seized more than 90 more from her home. The scheme brought in more than $17 million. In July 2025, a federal judge sentenced her to eight and a half years in prison.
Chapman was one case among many. In June 2025 the Justice Department announced it had searched 29 known or suspected laptop farms across 16 states and seized about 200 computers. North Korean workers had landed jobs at more than 100 American companies, many of them in the Fortune 500. At one California defense contractor, they got into files covered by U.S. weapons export controls. At an Atlanta blockchain company, they rewrote the company's own code and stole more than $900,000 in crypto.
The people whose names were stolen got hit too. Federal prosecutors said the Chapman scheme left 68 Americans with false tax bills, because the workers' pay was reported to the IRS and Social Security under their names.
How the Money Gets Cleaned
Stolen coins are useless until they can be spent, and North Korea has the cleanup down to a routine.
The hackers first convert what they can into Ethereum and spread it across hundreds of fresh wallets. The FBI's warning on Saturday listed 608 Ethereum addresses tied to the Binance theft. Then the coins go through bridges and swap services that move money from one blockchain to another without asking who owns it.
One stream of the Binance money ran through Tron, another blockchain. An analyst who tracks the hackers counted about $242 million laundered there in two days, through swap services called Relay, THORChain, Chainflip and Symbiosis. Elliptic found that the main wallet paid out every hour for 31 straight hours, repeating the same amounts again and again. Its co-founder said people are making the decisions while scripts do the repetitive work. Chainalysis reported that the hackers also parked digital dollars in a Tron lending service, swapped them for tokens that cannot be frozen and cashed out from new addresses.
The FBI asked THORChain's operators to block the stolen funds. The service has refused that kind of request before. Its founder has argued that if operators start shutting it down, "the experiment is over." On Saturday, a technical glitch forced THORChain to pause most of its trading anyway, and Chainalysis said the pause also stalled a large share of the laundering.
Where the Money Goes
After Russia vetoed the United Nations panel that tracked North Korean sanctions in 2024, the United States and ten allies formed their own team to keep watch. Its report found North Korea stole more than $2.8 billion in crypto from January 2024 through September 2025. A State Department official told the United Nations in January that the 2025 total likely topped $2 billion and called that a conservative low-end estimate.
Chainalysis puts North Korea's 2025 haul at $2.02 billion, up 51 percent from the year before. TRM Labs counted $2.9 billion stolen in all crypto thefts worldwide that year. The two firms count differently, but by those numbers one country took the large majority of all crypto stolen on Earth.
Once the coins are cleaned, brokers and middlemen in China, Russia, Cambodia and Vietnam turn them into hard currency, and it reaches the regime. In 2023 the White House's top cyber official, Anne Neuberger, said about half of North Korea's missile program is paid for by cyberattacks and crypto theft. South Korea's deputy ambassador to the United Nations has said North Korea is funding its nuclear weapons and ballistic missile programs by exploiting the crypto industry.
What Is Being Done
Punishing North Korea is close to impossible. It is already under nearly every sanction the world can impose. It extradites no one. Indictments like the one against Park Jin Hyok go nowhere.
What works is speed. Within a day of the Binance theft, Tether froze more than $1.5 billion, Circle froze more than $800 million and Ripple froze about $200 million. Those companies issue their own digital dollars and can lock them in place. Elliptic counts $2.85 billion frozen or seized so far, about 44 percent of what was taken. Two weeks after the Bybit theft, only 3 percent of that money had been frozen and about 20 percent had already vanished from view.
The rest is harder. About $3.25 billion of the stolen money sits in Bitcoin, XRP and other coins that no company can freeze. More than 18,000 Bitcoin are still parked in the 19 Bitcoin addresses the FBI listed, waiting.
The President said Saturday he was not concerned. "We don't know if it's North Korea, but if it is, we'll talk to them about it," he said. He also warned that "the bloodbath of AI hacking is to come."
The coins nobody froze are already on their way to Pyongyang.
THE END
— Brian Bullock / Everyone Knows Podcast | Starborne Studios | brianbullockwriter.com | X @EveryoneKnws1