The threat posed by North Korea online is again in focus, following a record cryptocurrency heist potentially linked to Pyongyang.
The US Federal Bureau of Investigation said Saturday that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance, the world's largest cryptocurrency exchange, on or around Oct. 29.
The theft is believed to be the largest single cryptocurrency heist on record.
The FBI attributed the operation to TraderTraitor, its name for a North Korean cyber campaign involved in cryptocurrency theft, and said the stolen assets were being converted primarily into ether then laundered through decentralized finance and instant-swap services.
Ether, on the Ethereum blockchain, is the world's second-largest cryptocurrency by market capitalization.
On Saturday, US President Donald Trump said Washington was still looking into whether North Korea was behind the attack and that he would raise the issue with Pyongyang if its involvement was confirmed.
"We're learning about it. We don't know if it's North Korea — but if it is, we'll talk to North Korea about it," Trump told reporters at Mar-a-Lago in Florida.
The FBI meanwhile urged cryptocurrency exchanges and other virtual asset service providers to block transactions involving digital wallet addresses linked to the stolen funds.
Activity traced to North Korean internet protocol addresses has also put South Korea's financial sector on alert.
South Korean financial authorities recently alerted banks, securities firms and cryptocurrency exchanges after about 4.4 million scanning attempts targeting local financial institutions were detected from IP addresses assigned to North Korea beginning at 3 a.m. on Oct. 21.
No actual breach linked to those addresses has been confirmed. Authorities, however, said the activity appeared aimed at identifying open network ports or security vulnerabilities that could later be exploited, prompting financial firms to review access logs and strengthen real-time monitoring.
The activity also coincided with indications that hackers suspected of links to North Korea were preparing broader attacks against governments and financial institutions.
Singapore-based cybersecurity firm Cyfirma said on Oct. 22 that it had detected Korean-speaking operators discussing attacks using two critical vulnerabilities in PHP, a widely used server-side programming language.
The firm said government agencies, banks and other financial institutions were among the operators' highest-priority targets, with South Korea, the US and Japan among the countries discussed.
Cyfirma also pointed to possible links to the Lazarus Group ecosystem, a North Korean state-linked hacking network known for financial theft and espionage.
North Korea has a long history of targeting South Korean institutions.
In 2024, South Korean police said Lazarus and Andariel in 2019 had stolen 342,000 ether, worth about 58 billion won ($43.5 million) at the time, from South Korean cryptocurrency exchange Upbit.
In March 2013, a major cyberattack attributed by South Korean authorities to North Korea disrupted the networks of Shinhan Bank, Nonghyup Bank and Jeju Bank, knocking out ATMs, online banking and other services.
The emergence of artificial intelligence appears to have further expanded the scale and speed of North Korea's cyber operations.
Microsoft Threat Intelligence said in a report released Thursday that three of eight major North Korean threat groups it examined had integrated AI into routine operations, placing them at the highest level of its four-stage assessment. The report also identified more than 100 AI-generated PDF lure files targeting South Korean users in August and September, with dozens created within minutes.
South Korea, for its part, has sought to bolster its cyber defenses.
On Oct. 4, the Ministry of Science and ICT said it and the Korea Internet & Security Agency had activated a 24-hour emergency response system, expanded cyber incident response personnel and strengthened monitoring of major corporate websites.
The government also recommended security checks to about 28,000 companies that have registered chief information security officers.
Such efforts have been accompanied by growing international coordination.
South Korea, the US and Japan operate a trilateral diplomatic working group on North Korean cyber threats, launched following their 2023 Camp David summit agreement to strengthen cooperation against Pyongyang's illicit cyber activities.
At its fifth meeting in Washington on June 25 and 26, officials discussed North Korea's cryptocurrency theft and laundering, overseas IT worker operations and other illicit cyber activities, as well as ways to strengthen coordinated responses.
Pyongyang has increasingly turned to cybercrime as a means of earning hard currency amid tightening international sanctions.
A UN sanctions monitoring report released in 2024 said malicious cyber activities accounted for roughly half of North Korea's foreign currency income, citing information provided by one member state, while another estimated that about 40 percent of its weapons of mass destruction programs were financed through illicit cyber means.
Blockchain analysis firm Chainalysis also estimated that North Korean hackers stole $2.02 billion in cryptocurrency in 2025, up 51 percent from the previous year, despite carrying out fewer attacks.
The amount brought North Korea's cumulative cryptocurrency theft to an estimated $6.75 billion by the end of 2025, according to the firm.
The Bank of Korea, meanwhile, estimated that the North Korean economy grew 3.5 percent on-year in 2025, following growth of 3.7 percent in 2024 and 3.1 percent in 2023.
