FOLLOW US

Relevant Cybersecurity Advisories:

• IC3 Public Service Announcement (2025)
• TraderTraitor Cybersecurity Advisory (2022)
• Hidden Cobra FASTCash Campaign (2018)
• North Korean Cyber Threat Advisory (2020)

A History of North Korean Hacking 

This is not the first large-scale cryptocurrency theft attributed to North Korean hackers. In 2023, the same state-sponsored group was responsible for a $600 million crypto theft.

North Korea first gained global notoriety for its cyber activities in 2014 when it allegedly hacked Sony Pictures in retaliation for The Interview, a satirical film starring Seth Rogen and James Franco, which depicted a fictional assassination attempt on North Korean Supreme Leader Kim Jong Un.

How North Korean Hackers Operate

North Korean hacker groups use a combination of technical expertise and social engineering tactics to compromise systems. Their primary techniques include:

• Deploying malicious TraderTraitor applications to gain access to victim networks.
• Exploiting security vulnerabilities to steal private keys.
• Laundering stolen funds through thousands of blockchain addresses before converting them into fiat currency.

The Lazarus Group and State-Sponsored Cybercrime

Despite lacking free public internet access, North Korea has developed an elite hacking force, including the infamous Lazarus Group, which has been linked to numerous financial crimes worldwide.

North Korean cybercriminals were also behind the 2017 WannaCry ransomware attack, which infected hundreds of thousands of devices in over 150 countries. Many experts believe these cyber activities help fund North Korea’s military and nuclear programs.

Growing Threat of N. Korean Cyber Attacks

The U.S. government has been issuing warnings about North Korean state-sponsored cyber actors since 2018. Given the scale and sophistication of these operations, cybersecurity experts continue to urge financial institutions, cryptocurrency exchanges, and blockchain developers to strengthen security protocols.

With Bybit’s recent hack, it is evident that TraderTraitor remains an active and dangerous threat to the world’s cryptocurrency security. The full extent of North Korea’s involvement in crypto-related cybercrimes is still unfolding, but one thing is clear—it represents a global cybersecurity crisis that demands immediate attention.