“Elite” crypto asset theft: North Korean hackers attack Binance – damage spread, Japanese companies also targeted

The North Korean hacker group Trader Trater (TT) is strongly suspected to be involved in the largest-ever asset leak that occurred at Binance, the world's largest crypto asset (virtual currency) exchange business. They are an "elite team" that specializes in crypto asset theft, and have targeted Japanese businesses in the past. North Korea is considered to be an important source of funds, with its means of acquiring foreign currency limited by sanctions imposed by the United Nations Security Council, and the scale of the damage is increasing.

North Korea faces hurdles in dealing with the theft of crypto assets, a “profitable tool” for nuclear funding, and sanctions are difficult

▽The crime took just 20 minutes.

At the end of October, Binance announced that approximately $6.3 billion (approximately 1 trillion yen) worth of crypto assets were leaked due to a cyber attack. The US Federal Bureau of Investigation (FBI) concluded that TT was responsible for the crime. According to US blockchain analysis company TRM Lab, the crime took only 20 minutes. His skill is outstanding.

TT is part of Lazarus, a subordinate organization of the Military Reconnaissance and Intelligence Directorate, which is responsible for North Korea's external affairs. According to a report by the Multilateral Sanctions Monitoring Team, which monitors the implementation of Security Council sanctions, it was formed between 2016 and 2017. From January 2024 to September 2025, crypto assets worth approximately $2.58 billion (approximately 400 billion yen at current exchange rates) were stolen, accounting for approximately 90% of the crypto assets stolen by North Korea during the same period.

▽Skillful "impersonation"

TT's specialty is to send files containing malware (malicious programs) to people involved in crypto-asset companies by cleverly posing as corporate recruiters or executives.

In the 2024 incident in which about 48.2 billion yen worth of money was leaked from the crypto asset exchange company DMM Bitcoin (Tokyo), a person posed as a recruiter on the business SNS LinkedIn and contacted an employee of a company that was contracted by DMM to manage the deposit and withdrawal of crypto assets. They are said to have infected computers with a virus via the URL they sent, obtained employee authentication information, and then infiltrated the management system and stolen assets.

In 2025, the FBI determined that TT was responsible for the leak of approximately $1.5 billion (approximately 240 billion yen) from the Dubai-based crypto asset exchange company ByBit in the Middle East. At the time, it was considered the largest amount of damage in history.

▽Require multiple signatures

Masayuki Hatta, a professor of management information at Surugadai University and an expert on cyberattacks, points out, ``They launch quite a few attacks with the feeling that all they need is one hit.'' It is possible that the success rate is increased by conducting mass attacks indiscriminately.

Furthermore, Hatta predicts that the number of attacks will increase with the use of artificial intelligence (AI). ``Given the premise that security can be breached with a certain probability, it is important to take measures such as requiring multiple signatures for withdrawals of crypto assets,'' he warned.