By Ahmed Abdelsalam
Blockchain security firms have attributed a massive hack of cryptocurrency exchange Binance to North Korean state-sponsored hackers, with at least $2 billion stolen in what may be the largest cyberattack on a crypto platform.
Three firms point to TraderTraitor unit
TRM Labs, Chainalysis, and ZachXBT concluded with high confidence that the attack was carried out by North Korea's TraderTraitor hacking unit, linked to the infamous Lazarus Group. TRM Labs based its assessment on robust on-chain and off-chain intelligence, while Chainalysis chief Jony Levin said the hack was likely done by TraderTraitor.
Shift from disruption to financial theft
Experts note a stark shift in North Korea's cyber strategy over the past decade, moving from disruptive operations like the 2014 Sony Pictures attack to stealing large sums from cryptocurrency wallets and central banks. The stolen funds are funneled into financing Pyongyang's nuclear weapons program.
Overseas operatives and infrastructure
Japan's foreign ministry warned that under Kim Jong Un, North Korea's cyber force has become a full-scope national program approaching the sophistication of China and Russia. With limited global internet connectivity, North Korean hackers operate from countries like China and Russia to access better infrastructure and mask their IP addresses.
Global network of agents
Reports indicate up to 6,000 North Korean cyber agents operate worldwide, including in China, India, Russia, Belarus, and Malaysia. They assume false identities to gain employment at foreign companies. Southeast Asia has emerged as a key region for both targeting and basing operations, with malware distributed in Cambodia, Thailand, and Indonesia.
Recruitment and training
Academically gifted students in North Korea are identified early and directed toward computer science and information security. Recruits entering intelligence services such as the Reconnaissance General Bureau receive privileges including unrestricted internet access and high salaries.
