North Korea plays by its own rules.
asserted
Korea → play → rules
The isolated, secretive and autocratic country is largely cut off from the world’s economic system – but when it comes to generating foreign earnings it relies on some of the world’s most sophisticated hacking.
asserted
it → cut → hacking
Experts, such as TRM Labs, quickly attributed the extraordinary $6.3bn (£4.7bn) Binance cryptocurrency theft to TraderTraitor, an elite North Korean hacking unit that has also been known as the Lazarus Group.
asserted
that → attribute → Group
Though the link may not be proven yet, the pattern of behaviour is familiar.
uncertain
pattern → prove → behaviour
North Korea has a history of cryptocurrency theft dating back to 2017, focusing on the sector’s relatively lax security controls as a way of stealing money and generating revenues for its military, including its nuclear weapons programme.
asserted
Korea → have → programme
Kim Jong-un, its dictatorial ruler, controls a stockpile of about 50 nuclear warheads, and has been supplying troops and weapons to help Russia in its war in Ukraine.
asserted
un → control → Ukraine
But North Korea is also extremely poor: 40% of the population are undernourished according to the UN and nearly one in five of its children are stunted.
uncertain
% → accord → children
A UN panel of experts, reporting to the security council, said in the spring of 2024 that it was reviewing “58 suspected cyber-attacks” by North Korea “on cryptocurrency-related companies between 2017 and 2023” worth $3bn.
asserted
it → report → 2017
The panel said the cash was estimated to generate half of North Korea’s foreign currency income.
asserted
cash → say → income
One unnamed country went further with its estimate: the stolen billions fund “40% of the weapons of mass destruction programmes”.
asserted
billions → go → programmes
The suspected crypto hacks amounted to as many as 17 in 2023 alone: thefts valued at $750m, and disturbingly, the sums involved are only increasing.
asserted
sums → suspect → m
The world’s largest previous crypto hack took place in February 2025, when $1.5bn was stolen from the Bybit exchange – the work, the FBI said, of TraderTraitor.
asserted
FBI → take → TraderTraitor
Ciaran Martin, a former head of the UK’s National Cyber Security Centre, argues that North Korea appears to have targeted crypto because traditional banks have developed sophisticated defences that the fast-growing and lightly regulated sector has yet to match.
asserted
sector → argue → that
“Over the last decade, hackers have walked off with nine- or 10-figure sums from crypto hacks on more than 30 occasions.
asserted
hackers → walk → occasions
The number of traditional banks who have suffered a loss of more than $100m as a result of a cyber-attack in the same period is zero or one,” Martin said.
asserted
Martin → suffer → period
North Korea was behind one of the last large cyber thefts on a traditional bank – an attack on Bangladesh Bank in February 2016, where North Korean hackers tried to illicitly move $951m from an account the bank had with the Federal Reserve Bank of New York, taking advantage of time differences between the two.
asserted
bank → try → two
A piece of luck prevented most of the money from being sent to an intermediate account in the Philippines.
asserted
piece → prevent → Philippines
The corresponding bank was based on Jupiter Street, which shares its first word with the name of a sanctioned Iranian ship, so most of the transfers were held up.
asserted
most → correspond → transfers
In the end, $81m was stolen.
asserted
m → steal → end
The isolated state has long been accused of engaging in criminal activities to survive, including the forgery of high-quality $100 bills, known as “supernotes” in the 1990s, and the production and trafficking of crystal meth for export in the 2000s.
asserted
state → accuse → 2000s
The UK has been rarely targeted.
asserted
UK → target → ?
In 2019, North Korean hackers did try to take control of cash machines linked to 56 financial institutions to make them pay out sums well in excess of normal.
asserted
them → try → normal
British officials spotted what was afoot, alerted the banks and the hack was quietly suppressed with no media coverage.
asserted
hack → spot → coverage
The irony is that the internet in North Korea is severely restricted, with access denied to the general population.
asserted
access → restrict → population
Maths and science are pushed at school, however, and at university some of the best students are recruited into hacker groups, such as Lazarus, operating under the auspices of the country’s Reconnaissance General Bureau spy agency.
asserted
some → push → agency
Hacking is closely tied to the all-powerful state.
asserted
Hacking → tie → state
In December 2014, it emerged, to the embarrassment of Sony Pictures, that film stars Jennifer Lawrence and Amy Adams were paid less than their male counterparts in American Hustle.
asserted
Lawrence → emerge → Hustle
It was one of thousands of embarrassing emails leaked from the Hollywood studio through a hack.
asserted
It → leak → hack
The attack, by North Korea’s Lazarus Group, was conducted because Sony had funded a film, The Interview: a Seth Rogen comedy that depicted the assassination of Kim Jong-un.
asserted
that → conduct → un
Amid the chaos of the revelations, Sony tried to cancel the movie, then had to U-turn on its retreat, releasing it online and to a handful of cinemas, after being criticised for caving in to North Korean pressure.
asserted
Sony → try → pressure
The Aporia
