The Binance theft is the visible part of something steadier. North Korea has built a way of earning foreign currency that routes around the financial system it has been shut out of, and stealing cryptocurrency is one of two arms of it.
International sanctions limit the country’s access to the global financial system. Conventional banking transactions are difficult, and foreign investment and trade face obstacles. In that position, cyber-crime became a source of hard currency — in particular, attacks on cryptocurrency exchanges and custodians.
The scale
According to the blockchain analysis firm Chainalysis, hackers linked to North Korea stole at least $2.002bn in cryptocurrency during 2025 — 51% more than the year before. Taking everything up to the end of that year, the running total attributed to North Korea-linked hackers stands at about $6.75bn.
Then came Binance, which on its own is close to the whole of that preceding decade.
Chainalysis also notes a shift in the shape of the activity: the number of attacks has fallen while the amount taken has risen. Fewer break-ins, much larger hauls. That is a change in method rather than in appetite.
The other arm
Stealing is not the only route. The country also earns by placing IT workers abroad under false identities — people hired by ordinary companies as remote staff, whose wages flow back. International investigations reported by Reuters have connected these proceeds to North Korea’s nuclear and missile programmes.
The hard part is not the theft
Taking the money is not the difficult step. Converting it into funds usable in the international financial system is. That requires multiple digital wallets, several blockchains, crypto exchanges and a network of laundering intermediaries.
A report published in October 2025 by the Multilateral Sanctions Monitoring Team — set up by the United States, South Korea and Japan — found that North Korea uses networks of intermediaries based in China and elsewhere to move stolen cryptocurrency.
This is the context worth holding on to when the Binance figure is quoted. The headline is one exchange on one Thursday. The thing underneath it is a standing operation with revenue targets, and a conversion problem it has spent a decade solving.
The fake worker problem is closer than it looks
Of the two arms, the IT-worker scheme is the one that touches ordinary companies directly. It does not require anybody to be hacked. It requires a company to hire a remote developer who is not who they say they are.
That makes it a hiring problem rather than a security one, and the usual defences do not apply. A firewall does not help against a contractor who has been given credentials legitimately, and the work is often genuinely delivered — which removes the obvious signal that something is wrong.
For countries with large outsourcing and freelancing sectors the risk is reputational as well as practical. Every fraudulent remote hire that is discovered makes clients slower to trust the next unfamiliar name on a platform, and the people who pay for that are the legitimate freelancers competing for the same contracts.
Why the totals keep rising
The pattern Chainalysis describes — fewer incidents, larger amounts — usually means the attacker has moved up the supply chain. Stealing from individuals scales badly; stealing from the institution that holds everyone’s assets scales very well indeed.
That is the direction of travel, and it puts the burden on a small number of exchanges and custodians whose failure would be felt by millions of people at once. The Binance figure is not an outlier in that trend. It is the trend arriving.
