North Korea has built one of the world's most effective state-sponsored theft operations, and it runs almost entirely through cryptocurrency exchanges. The Lazarus Group — also known as TraderTraitor — is an elite hacking unit operating under Pyongyang's Reconnaissance General Bureau. Its latest suspected operation, a $6.3bn theft from Binance, would be the largest single heist in history. The pattern is not new, but the scale is accelerating. The economics are stark. A UN panel reviewing 58 suspected cyber-attacks between 2017 and 2023 estimated stolen crypto generates half of North Korea's foreign currency income. One unnamed country's assessment goes further: the stolen billions fund 40% of Kim Jong-un's weapons of mass destruction programmes. In a country where 40% of the population is undernourished and nearly one in five children are stunted, the regime has made a clear allocation choice — hacking revenues flow to warheads, not food. The targeting logic is simple and rational. As Ciaran Martin, former head of the UK's National Cyber Security Centre, points out: hackers have walked off with nine- or ten-figure sums from crypto hacks on more than 30 occasions over the past decade. The number of traditional banks that have suffered a loss exceeding $100m from a cyber-attack in the same period is zero or one. Crypto exchanges offer vastly larger payoffs with weaker defences. North Korea learned this lesson after its 2016 Bangladesh Bank hack, where a fluke — an intermediate bank located on Jupiter Street, flagged because "Jupiter" matched a sanctioned Iranian ship name — prevented the theft of $951m, limiting the take to $81m. The pipeline from keyboard to warhead is remarkably direct. North Korea pushes maths and science in schools, recruits top university students into hacking units, and operates them under military intelligence. Internet access is denied to the general population but weaponised by the state. The Lazarus Group's portfolio extends beyond financial theft — its 2014 hack of Sony Pictures, retaliation for a comedy depicting Kim Jong-un's assassination, demonstrated the unit's range and the regime's willingness to use cyber operations for political coercion. This is not a new pattern for Pyongyang. The regime has a decades-long history of state-sponsored crime: forging high-quality $100 "supernotes" in the 1990s, producing and trafficking crystal meth for export in the 2000s. Crypto theft is the latest iteration — higher-yield, lower-risk, and harder to trace. The 2023 alone saw an estimated 17 separate crypto hacks worth $750m, and the February 2025 Bybit theft of $1.5bn — attributed by the FBI to TraderTraitor — showed the trajectory is still upward. The structural vulnerability here is not North Korean capability but crypto industry fragility. The sector's relatively lax security controls, light regulation, and rapid growth have created an attack surface that a determined state actor can exploit repeatedly. Traditional banking spent decades building layered defences; crypto exchanges are still catching up. Every dollar stolen flows into a nuclear programme controlled by a regime that is simultaneously supplying troops and weapons to Russia's war in Ukraine. The uncomfortable question is whether the crypto industry's resistance to regulation is effectively subsidising North Korean nuclear proliferation. The theft volumes are not incidental — they are structurally significant to Pyongyang's military budget. Until exchange security matches traditional banking standards, the Lazarus Group has a standing invitation to keep extracting.
