Photo via The Hindu

North Korean hackers linked to crypto thefts among world's best, experts say

Read the original at The Hindu ↗
Cite

Reuters. (2026, October 31). North Korean hackers linked to crypto thefts among world's best, experts say. The Hindu. https://www.thehindu.com/sci-tech/technology/north-korean-hackers-linked-to-crypto-thefts-among-worlds-best-experts-say/article71648161.ece

Dated from the outlet's own feed. Check the original for its byline.

The Hindu · collected 2026-10-31 · by Reuters

Quick Summary

Cybersecurity experts suggest that North Korean hackers, likely responsible for stealing $6.3 billion from Binance, are among the most active crypto thieves globally. These thefts help finance North Korea’s weapons programs; since 2025, the country has stolen at least $13.5 billion in cryptocurrency through various hacks on exchanges like ByBit and Bitget. The hackers use sophisticated tactics such as malware and fake job offers to target developers and IT staff, gaining access to sensitive data needed for financial transactions.
Written by AI on 2026-10-31, from this article's own text only (the story summary below draws on all the coverage).

AI analysis

Story summary

On October 29, Binance, the world's largest cryptocurrency exchange, reported a potential security issue that led to massive transfers of funds, prompting concerns of a hack. Stablecoin issuers Tether and Circle froze over $1.5 billion in assets related to this incident by October 30. By late October 30, Binance stated at least $2.54 billion in crypto funds had been frozen as the company suspended all deposits and withdrawals to investigate further. On October 31, Binance confirmed a significant security breach resulting in an estimated loss of up to $6.3 billion, making it potentially the largest cryptocurrency theft ever recorded. This event has raised broader concerns about the safety and risks involved with digital assets, impacting investor confidence significantly. Experts from blockchain analysis firms like TRM Labs and Chainalysis suspect North Korea’s state-backed hacking group, the Lazarus Group, to be responsible for this major heist.

Written for “Binance Hack Linked to North Korea” on 2026-10-31, grounded in this article and the 37 other(s) covering the same event.
Why this leaning score
The article's own words the score was based on. Each is quoted verbatim and was checked against the article text before being stored, so you can find it in the original.
Reading Leans strongly right (beta estimate) Confidence high
Leaning: leans strongly right for article 119025 (high confidence, 1 verified quote) · logged 2026-10-31

Story

📰 Binance Hack Linked to North Korea
Technology · 38 article(s) covering the same event. Compare every outlet's account →

Compared with similar articles

This article reads leans strongly right and hedges 0% of its claims. Each row says how that neighbour differs.
Toronto Star
Hedges 0 of 24 claims Outlet record 64/100
NPR
Hedges 1 of 26 claims Outlet record 60/100
BBC News
Hedges 2 of 23 claims Outlet record 68/100
BBC News
Hedges 2 of 23 claims Outlet record 68/100
CBS News
Hedges 0 of 13 claims Outlet record 66/100
“The articles describe different aspects of North Korean cyber activities; one sanctions those involved in IT worker fraud, while the other discusses a major cryptocurrency theft.”
The Sydney Morning Herald
Hedges 7 of 28 claims Outlet record 61/100
BBC News
Hedges 0 of 5 claims Outlet record 68/100
CBC News
Hedges 2 of 27 claims Outlet record 60/100
CBS News
Hedges 1 of 26 claims Outlet record 66/100
How this article was measured signals, leaning charts, publisher record, byline, topics and claims

Signals How these are calculated →

Claims extracted
16
sentences that state something as happening or true
Uncertain
0%
0 of 16 hedged ("reportedly", "may", "according to")
Leaning
Leans strongly right
of the writing, not the subject · beta estimate
Publisher signals
77/100
The Hindu's corrections and hedging, across everything collected from it. Not a measure of accuracy.
Outlets on this story
38
Technology
Same framing elsewhere
1
articles that frame the event the way this one does
Analyzed 2026-10-31 · how these are computed

How this is being covered How these are calculated →

Article leaning vs. publisher reliability
Source leaning vs. consistency

Publisher

The Hindu · 719 article(s) · 2 correction(s) detected
Running correction rate · 2 correction(s)

Who wrote this

Reuters
786 article(s) here · 0 carrying a prediction
🔮 “Why would the Field Marshal be going twice if it is not for some positivity?
🔮 “Why would the Field Marshal be going twice if it is not for some positivity?
🔮 Meta had settled with S.J. days before the trial, so Friday’s settlement with K.D.B. means the trial is expected to proceed against Snap only.
🔮 “My duty now is not to focus on discussing whether I will remain in office, but on solving the problem, determining exactly what happened and providing clear explanations,” Puente said at a press conference on Friday.
🔮 The global crypto insurance market was valued at $9.37bn in 2025 and is projected to reach $184.98 billion by 2033, according to Data Bridge Market Research.
2026-10-30 · mixed framing · Binance's $6.3bn hack: How crypto insurance works
🔮 No further victims were expected to be found, regional authorities said.
🔮 “This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it,” Binance wrote on X. The firm earlier posted a series of sometimes contradictory messages, insisting that “user funds are completely safe” but also saying it would “cover all losses.
🔮 Now in Year 2 of the revamped format, the league will hold its first-ever Game 7 with a first-time champion awaiting on either side.
🔮 Everton will travel to League Two side Fleetwood, who stunned Premier League champions Arsenal on Tuesday.
🔮 Later on Thursday, the Republican National Committee said in a statement that it would also cancel a planned rally in Iowa, home to several competitive congressional races.
Wire or desk byline, not an individual reporter.
Also by Reuters
Nothing else under this byline is closely related to this article, so these are simply their most recent.
All 786 articles by Reuters →

Topics

Binance Chainalysis FBI North Korean TraderTraitor

Subjects

North Korean NORP · 7× Barnhart PERSON · 4× Binance ORG · 3× North Korea GPE · 3× TraderTraitor ORG · 3× Chainalysis ORG · 2× FBI ORG · 2× North Korea’s GPE · 2× Russia GPE · 2× TRM Labs ORG · 1×

Narrative

The group also hit Bitget, a separate exchange, taking $387 million in September, experts have said, bringing the minimum total of cryptocurrency North Korea has stolen to roughly $13.5 billion, said Michael Barnhart, a researcher with cybersecurity firm DTEX. Binance said it and others were working to freeze some of the stolen cryptocurrency, with about $3 billion located so far. “After Bitget, a lot of the community expected something like this,” Barnhart said.
framing: assertive · carried by 1 article(s) · first seen 2026-10-31

Claims (16 extracted, 0 hedged)

North Korean hackers likely behind the record $6.3 billion theft from cryptocurrency exchange Binance are among the world’s most prolific crypto thieves, and the proceeds help fund the country’s weapons programs, cybersecurity experts said on Friday. asserted
experts → help → Friday
Blockchain investigation firms TRM Labs and Chainalysis attribute the heist to a North Korean hacking group known as “TraderTraitor,” a name used in a 2022 joint warning from the FBI, CISA and US Treasury that described how hackers used malicious software and other tricks to target software developers and IT staff at cryptocurrency companies. asserted
hackers → attribute → companies
North Korea stole at least $6.75 billion in cryptocurrency through the end of 2025, Chainalysis said in a December 2025 report. asserted
Chainalysis → steal → report
That total includes the $1.5 billion ByBit exchange hack in February 2025. asserted
total → include → February
The group also hit Bitget, a separate exchange, taking $387 million in September, experts have said, bringing the minimum total of cryptocurrency North Korea has stolen to roughly $13.5 billion, said Michael Barnhart, a researcher with cybersecurity firm DTEX. Binance said it and others were working to freeze some of the stolen cryptocurrency, with about $3 billion located so far. “After Bitget, a lot of the community expected something like this,” Barnhart said. asserted
Barnhart → hit → this
TraderTraitor is North Korea’s “most capable hacking group with a primary focus on financials and one staffed by some of the most experienced operators in the regime’s cyber programs in the former APT38 ranks,” he added, referring to North Korea’s long-running financially focused hacking units. asserted
he → staff → units
Researchers say TraderTraitor targets developers and IT staff at financial institutions through malware or phony job offers, tricking candidates into downloading malicious software during fake job interviews, giving the hackers access to login credentials and other sensitive data. asserted
TraderTraitor → say → credentials
Rafe Pilling, a senior director of threat research at Sophos, said early reports of how the hackers compromised Binance match the North Korean playbook, and that the group is expert at working out how a company’s systems and staff approve money transfers. asserted
systems → say → transfers
“This group in particular are somewhat artists in terms of getting into these distributed finance companies,” he said. asserted
he → get → companies
After stealing the money, the hackers pass it to Chinese organised crime money-laundering groups, Barnhart said. asserted
Barnhart → steal → groups
North Koreans also secretly take jobs at tech and financial companies in the US and other countries to earn money to send back to the North Korean government and steal sensitive data, the FBI said in an October 13 public service announcement, adding that money raised by the workers and hackers helps fund North Korean nuclear and military programs. asserted
money → take → programs
A US State Department spokesman said North Korean cybercrime is a “global problem” and that the country has “increasingly turned to cybercrime to circumvent international sanctions and fund its unlawful weapons of mass destruction and ballistic missile programs. asserted
country → say → destruction
Cryptocurrency heists and laundering have become a significant part of this strategy.” asserted
heists → become → strategy
North Korean leader Kim Jong Un has called for the country to seize “absolute superiority” in drone and other military technology, and the drone program’s gains are directly tied to the heists and the overseas IT worker schemes, Barnhart said. asserted
Barnhart → call → heists
The country is also aiding Russia’s war effort, he added. asserted
he → aid → effort
“North Korea has sent troops, munitions, and weapons components to Russia, all funded through the same system, which is why a crypto hack is a national security issue and not only a problem for the exchange that got hit,” Barnhart said. asserted
Barnhart → send → exchange
💬Give feedback
🕘History 🎫Support