It’s always North Korea

Within hours of the $6.4 billion Binance hack, before the blockchain analysts had begun to weigh in, someone suggested the thief might be North Korea. “Very likely,” I said. It wasn’t some bold guess; North Korea is behind almost every crypto theft of this size. Since then, I’ve gotten a lot of questions: How do we know it was North Korea? How do they cash out? What do they do with the money? Here’s a quick primer.

North Korea gets away with $3 billion from Binance

Stablecoin issuers froze about $2.4 billion of the roughly $6.3 billion stolen. The rest exceeds Binance’s insurance fund, and the man promising to make users whole isn’t supposed to be running the company.

Citation NeededMolly White

The largest crypto hacks in recent history — Bybit ($1.5 billion in 2025), Axie Infinity ($620 million in 2022), Bitget ($388 million in 2026) — have all been blamed on the DPRK. According to a Chainalysis report from last year, its state-sponsored hackers had stolen at least $6.75 billion in crypto by the end of 2025.¹ This year, the DPRK was responsible for 76% of the losses across all crypto hacks, according to TRM Labs.² These are just based on the known hacks and what can be attributed to them; the real figure is likely higher.

How do we know it was North Korea?

To be clear, neither Binance nor law enforcement has publicly attributed the hack to North Korea yet. But blockchain analytics firms TRM Labs,² Elliptic,³ and Chainalysis⁴ all have, and all three have been tracing North Korean crypto thefts for years.

Few attackers are sophisticated enough to pull off an attack of this scale. And DPRK hackers have also developed something of a signature when it comes to crypto thefts: how they fund attacker wallets and make test transactions, and how they launder the funds after the theft. Sometimes wallets from previous hacks are reused (for example, Elliptic has linked one of the destination wallets from this hack to the Bitget theft earlier this year³). However, they are also constantly changing their techniques as law enforcement and crypto platforms try to recover, or at least freeze,^a stolen assets.

The DPRK is mostly winning this arms race — outside of extremely quick action to freeze funds right after the attack (like we saw with Tether and Circle here, which is what brought Binance’s $6.4 billion in initial losses down into the $3–4 billion range) the majority of funds stolen by the DPRK are never recovered.

Not all freezes work the same way. Of the roughly $3 billion frozen after the hack, about $2.4 billion was denominated in the USDT and USDC stablecoins, whose issuers (Tether and Circle) can burn and reissue them to Binance. That money will almost certainly be recovered. The other ~$600 million was frozen by various, as-yet mostly unidentified, protocols. Tether and Circle have mostly abandoned crypto’s early ideals of decentralization and immutability, which is why they can claw funds back. Assets still designed around those ideals can’t always be returned so easily. Some funds may end up stuck where neither the attacker nor Binance can reach them, meaning that Binance’s losses will likely exceed the DPRK’s profits.

How does the DPRK cash out?

Shortly after a hack, DPRK hackers rapidly launder the funds through crypto mixers (think Tornado Cash) and other decentralized finance projects, or bridge them across blockchains, to make them harder to trace.

When they want to cash out, they turn to exchanges with little to no identity verification, “money mules” who can pass AML checks, criminal escrow services like Tudou Danbao, Chinese-language platforms like Huione, and banks or money laundering services in less regulated jurisdictions like China and Russia. They also use off-chain avenues to cash out, like OTC brokers. 

Or they may not cash out at all. A 2025 report from the international Multilateral Sanctions Monitoring Team (MSMT) noted that the DPRK had used stablecoins directly “for procurement-related transactions, including the sale and transfer of military equipment and raw materials such as copper, which is used in munitions production”.⁵

What does the DPRK do with most of this stolen crypto?

With the country under heavy UN sanctions, crypto theft has become a major revenue stream. US officials also claimed in 2023 that around 50% of the DPRK's ballistic missile program was funded by its cybercrime.⁶

North Korea’s timing was inconsiderate: I’m in the middle of an election night guide to crypto and AI super PAC spending, covering which races to watch, which races are real battlegrounds and which are safe seats to pad their win rates, and what their ads were actually about (spoiler: rarely crypto or AI). Subscribe to get it before Tuesday, assuming no one else loses a few billion dollars this weekend.