A MARTÍNEZ, HOST:
Trading resumes Sunday on Binance, the world's largest cryptocurrency exchange. Some transactions were halted on Thursday after hackers stole some $6.3 billion in cryptocurrencies, the largest such theft on record. The FBI says North Korea is behind the hack. NPR's Anthony Kuhn joins us from Seoul to discuss North Korea's rise as a cyber power. Anthony, so what's the evidence that North Korea is behind the heist?
ANTHONY KUHN, BYLINE: North Korea itself has neither confirmed nor denied responsibility for the job, A. They have in past denied responsibility for similar hacks. But researchers and law enforcers associate some of the methods used in this hack with North Korean actors. Binance, for example, says hackers may have been able to get access to a Binance engineer's laptop, which then allowed them to submit unauthorized withdrawal transactions. That looked familiar. Another sign is that crypto transactions are recorded on public ledgers on blockchains, and researchers and law enforcement can watch those transactions in real time, and they say they traced transactions to accounts that they said were linked to North Korea.
MARTÍNEZ: So, Anthony, was this a complete success for the hackers?
KUHN: Apparently not. I spoke to Ari Redbord, the head of global policy for TRM Labs, a firm that monitors the blockchains. And he told me that crypto firms were able to freeze more than 40% of the stolen assets, so hackers couldn't cash them out.
ARI REDBORD: I think the 2.0 version of this story is we had the largest hack, largest, you know, theft in human history. We had an incredible job of the ecosystem coming together to freeze assets. But now North Korea's going to try to launder the rest and convert whatever it can.
KUHN: In other words, at the same time as the hackers are improving their offensive capabilities, the crypto industry is also stepping up its defenses.
MARTÍNEZ: What about the identity of the alleged North Korean hackers?
KUHN: The FBI attributes the hack to a hacker group called TraderTraitor. That's an arm of a larger unit called the Lazarus Group, which is under North Korean military intelligence. Now, military intelligence oversees North Korea's cyber warfare operations, which include sabotage, spying and moneymaking. And of these, moneymaking is believed to have risen to be their top priority.
According to a United Nations Security Council Panel of Experts report, cyber theft now provides about half of North Korea's foreign currency earnings. And it funds about 40% of its weapons of mass destruction. And the cyber units are also involved in everything from psychological warfare and ransomware to getting its agents hired as remote IT workers at foreign companies.
MARTÍNEZ: Now, how can a country like North Korea that's isolated, in which most people have no internet access, become such a cyber power?
KUHN: Well, for years, North Korea has prioritized cyber operations because they see them as cheap and covert and deniable. In other words, it means a cyberattack is probably not going to trigger a war. They also see cyberweapons as versatile tools for advancing the state's key aims, which include keeping the family of leader Kim Jong Un in power and building their nuclear arsenal and also evading sanctions. South Korea's spy agency estimates that as of 2024, North Korea had over 8,400 trained cyber warfare agents, with thousands more involved in training and other support roles both inside North Korea and overseas. And they select operatives for training from a very young age. And these operatives enjoy better pay and elite status compared to other personnel.
MARTÍNEZ: All right. That's NPR's Anthony Kuhn joining us from Seoul. Thanks a lot, Anthony.
KUHN: Thank you, A.
(SOUNDBITE OF FRENIC SONG, "DEATHLESS AUDIO") Transcript provided by NPR, Copyright NPR.
NPR transcripts are created on a rush deadline by an NPR contractor. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.
