FBI links $6.3B Binance heist to North Korean hacking group TraderTraitor
IT workers earn $10,000 a month abroad, sending over 90% back to Pyongyang
UK firms hit by hacking and job fraud as North Korea seeks cash and intelligence
North Korea has been identified as the force behind the theft of approximately $6.3 billion in virtual assets from Binance — and around the same time, North Korean IT workers were spotted attempting to infiltrate British companies by posing as foreign developers. Though direct hacking and covert employment abroad are distinct methods, both serve the same purpose: helping Pyongyang secure funds and access overseas technology while evading international sanctions.
The FBI announced Saturday that North Korea was responsible for the Binance heist, attributing the operation to a North Korea-linked hacking group called TraderTraitor. The bureau warned that the hackers may attempt to launder the stolen assets — primarily converted into Ethereum — through decentralized finance, or DeFi, services. Blockchain analytics firm TRM Labs said approximately $6.36 billion was moved across 10 blockchains, with most transfers completed within about 20 minutes. Binance said it has covered 90 percent of the losses.
North Korea's foreign currency operations extend well beyond virtual asset theft. The Daily Telegraph reported Saturday, citing British business figures and security experts, that North Korean IT workers have set their sights on the UK job market. Operatives based in China, Russia and Southeast Asia assume the identities of local residents or third-country nationals and apply for remote positions. They submit applications in bulk, and once hired, funnel most of their salaries back to North Korea.
A report by the Multilateral Sanctions Monitoring Team estimated that North Korean overseas workers operate in at least 17 countries. The average monthly income of a North Korean IT worker abroad is around $10,000, with more than 90 percent of earnings remitted home. Governments and analysts broadly agree that the regime channels these workers' income into nuclear and missile development.
The sheer volume of applications is what makes the scheme viable. Cybercrime researcher Adrian Cheek estimated the success rate for North Korean IT workers at roughly 0.3 percent — low, but high enough that some operatives may receive more than one job offer per day given the scale of their efforts. Blockchain and cybersecurity firms are primary targets. In the UK, North Korean workers were found to have applied to two major banks, a pharmaceutical company and civil service positions. Whether any of the civil service applications resulted in actual hiring has not been confirmed.
Suspicious behavior has surfaced during interviews. The Telegraph covered an interview conducted in August by fraud-detection firm Cside with a candidate who claimed to be a developer from Tennessee. During the session, the applicant's eyes frequently drifted off screen and the video and audio cut out repeatedly. When the interviewer asked the candidate to wave a hand in front of the camera to check for deepfake manipulation, the call ended immediately.
Some operatives have gone further, posing not as job seekers but as recruiters — a tactic aimed at gathering labor market intelligence or gaining access to strategic sectors such as aerospace and defense. A joint advisory issued in July by 11 countries, including the United States, South Korea and the United Kingdom, warned that North Korean IT workers use false identities, overseas proxies and remote access tools and may be involved in stealing corporate data or committing virtual asset crimes.
Hacking and covert employment work differently, but share a common thread: both exploit corporate digital systems and hiring processes. While hacking enables the direct theft of assets, fraudulent employment generates salaries and potentially opens doors to internal systems. The Binance case has once again thrown the scale of North Korea-linked cyber activity into sharp relief, putting identity verification in corporate hiring and remote work arrangements at the center of the security agenda.
attom@heraldcorp.com
