Britain · UK Today
O n Thursday night, bad actors stole approximately $6.3bn from Binance , the world's largest cryptocurrency exchange. Most of the money was moved across ten different blockchains in about 20 minutes. North Korea's notorious TraderTraitor hacking group is believed to be behind it.
If confirmed, this would be the largest cryptocurrency theft in history, more than four times the previous record. Binance says around $3bn has already been frozen and has promised to cover customer losses. But billions remain outside the reach of those freezes.
None of this should come as a surprise. And the fact that it did is what worries me. In February last year, North Korean hackers stole $1.5bn from another cryptocurrency exchange, Bybit.
At the time, that was the largest crypto heist ever recorded. In fact, that was the case that got me into investigating cryptocurrency money laundering . I couldn't understand how a country facing some of the toughest financial sanctions in the world could steal $1.5bn and then move that money around the global financial system.
If North Korea could do that, I thought, what else was happening that nobody was paying attention to? I spent months going through court records, indictments, and blockchain investigations. Eventually, I built the Global Cryptocurrency Laundering Database , which uncovers 164 documented cases and more than $350bn in illicit crypto-linked flows.
One of the most shocking findings was just how heavily involved North Korea was in these cases. Of all the cryptocurrency hacks in my database, North Korea was responsible for 30 per cent of them . North Korea has organised and aligned resources behind this malicious activity.
Most governments have cyber-defence departments whilst North Korea has a cyber attack division , which provides their main source of government income. In the past four years it has been behind the $620mn Ronin network hack in 2022, the $308m DMM Bitcoin theft in 2024, and the $1.5bn Bybit hack in 2025. Just last month, North Korean hackers were implicated in another theft of approximately $387m from Bitget.
Now they have just stolen another $6.3bn. To understand the scale, Bloomberg recently estimated that North Korea generated as much as $22bn in foreign revenue over the four years from 2022 to 2025. The cryptocurrency stolen in yesterday’s attack is equivalent to nearly 29 per cent of that entire four-year figure.
Even though billions have already been frozen, a fraction of this amount would represent an enormous windfall for Pyongyang. What is clear to me is that governments cannot afford to keep treating the biggest crypto heist in history as simply another cyberattack. They can take several steps to stop the Hermit Kingdom reaping the rewards.
For a start, the money is only useful to North Korea if it is able to be spent. To do just that, it first has to be converted. After a hack, stolen funds are moved through thousands of cryptocurrency wallets, swapped into different cryptocurrencies and transferred across blockchains to make tracing more difficult.
But eventually the hackers need to cash out, and that generally means relying on exchanges, brokers and other financial intermediaries. This is where governments should be concentrating their efforts to stop it. The US, UK and EU need to make it practically impossible for North Korean hackers to convert stolen cryptocurrency into usable funds.
Exchanges should be required to act immediately when stolen assets are identified, freeze funds where they have the ability and legal authority to do so, and share information with law enforcement. Those who are facilitating the laundering should face consequences. North Korea doesn't launder everything itself, but instead relies on intermediaries elsewhere to do the job.
Any exchange, broker or financial institution knowingly helping North Korea cash out stolen cryptocurrency should therefore be sanctioned. Their assets should be frozen, and their access to Western financial markets cut off. We already do this with banks helping sanctioned governments move money.
Cryptocurrency exchanges shouldn't get a free pass. There is also another problem that governments have so far largely ignored: protecting the people whose money is being stolen. Binance has promised to cover customer losses.
But not every exchange has the resources to do that. In previous hacks, customers have seen their savings frozen, lost or tied up in lengthy recovery proceedings. Why should ordinary investors be left to pay the price when an exchange fails to safeguard their assets?
The FCA states that people should expect to lose all their money if they invest into cryptocurrency. However, people ignore this advice and today crypto makes up 66 per cent of all the fraud reports alone. Governments need to regulate cryptocurrency exchanges properly, with mandatory cybersecurity standards, independent audits and clear rules ensuring customers are compensated when an exchange's security failures lead to losses.
North Korea will continue carrying out these attacks for as long as they remain profitable. And with billions potentially available from a single hack, it has every incentive to keep trying. Until we cut off the exchanges and intermediaries allowing this money to be cashed out, Kim Jong Un has little reason to stop.
Source: The Independent
