North Korea’s cryptocurrency thefts fund illicit weapons, other military efforts, analysts say
FORUM Staff
North Korean hackers suspected of stealing $6.3 billion in cryptocurrency in late October 2026 are funding Pyongyang’s illicit nuclear weapons and ballistic missile programs and other military activities, including aiding Russia in its conflict with Ukraine, analysts say.
North Korean cybercrime is a global threat, the United States State Department said. Pyongyang has “increasingly turned to cybercrime to circumvent international sanctions and fund its unlawful weapons of mass destruction and ballistic missile programs. Cryptocurrency heists and laundering have become a significant part of this strategy.”
The North Korean hacking group TraderTraitor is accused of the theft from Binance, the world’s largest cryptocurrency exchange. North Korean hackers are believed to have stolen $13.5 billion in cryptocurrency in recent years.
Binance said the hackers used fake job interviews and a tool equipped with super intelligence, also known as artificial intelligence. They targeted a Binance engineer on the LinkedIn professional networking site and arranged a series of purported employment interviews to persuade the engineer to download a fake assignment that allowed TraderTraitor to access the company’s systems.
North Korea’s military technology, including uncrewed systems, and its aid to Moscow are tied to cyber theft and the regime’s overseas worker schemes, analysts say.
“North Korea has sent troops, munitions and weapons components to Russia, all funded through the same system, which is why a crypto hack is a national security issue and not only a problem for the exchange that got hit,” Michael Barnhart, a researcher with cybersecurity firm DTEX, told the Reuters news service.
Pyongyang recruits university students and sends them to hacker units overseen by North Korea’s intelligence agency, the British Broadcasting Corp. reported. The regime also deploys information technology (IT) workers to conduct malicious cyber activities to finance the regime’s illicit activities and circumvent United Nations Security Council resolutions.
— STORY CONTINUES BELOW —
Join the discussion
How can your nation work with Allies and Partners to enforce international sanctions and stem the North Korean regime’s illegal activities?
The U.N. Security Council has adopted nine major resolutions sanctioning North Korea over its nuclear and missile activities since 2006. The U.N. called for Pyongyang to abandon its nuclear program in a “complete, verifiable and irreversible” manner, end its ballistic missile activities, and return to nuclear reduction talks. The resolution froze the financial assets of entities the Security Council determined were supporting the regime’s weapons programs.
Instead, the regime’s IT workers use false documents and stolen identities to obtain freelance employment from targets in East Asia, Europe and North America, according to the Japanese and Republic of Korea foreign ministries and the U.S. State Department. The IT workers extort victims using “threats of physical violence to demand payments,” the U.S. Federal Bureau of Investigation said in October 2026.
That same month, Australia imposed financial sanctions and travel bans against individuals and entities facilitating the IT worker scheme, which also violates U.N. resolutions prohibiting North Korea from exporting labor.
“Australian sanctions reinforce our ongoing efforts, alongside international partners, to disrupt North Korea’s illicit revenue-generating networks and increase pressure on the regime to comply with its international obligations and abandon its nuclear and ballistic missile programs,” the Australian Foreign Ministry stated.
