The Reconnaissance General Bureau is North Korea's primary intelligence and spy agency that oversees dedicated cryptocurrency cyber theft units

Overview Debates Related claims Topics

The Federal Bureau of Investigation indicated that North Korean state-sponsored hackers were responsible for a Binance exchange hack

During the October 29 Binance hack, the attacker pre-signed 50 transactions with differing nonces to execute a transaction on the Binance hot wallet

Following the October 29 Binance hack, automated scripts distributed funds from the original 10 attacker wallets across over 100 new addresses, then fan-out split them across more than 400 addresses

On Thursday, October 29, at approximately 4:00 PM Eastern Time, Binance suffered a hack that drained approximately $6.3 billion to $6.4 billion in assets

According to Chainalysis data, North Korea-linked operations accounted for 15% of total reported cryptocurrency hack losses in 2021

The October 29 Binance hack transferred over $6 billion in cryptocurrency within a 20-minute window

Following the LayerZero security incident, North Korean hacking group TraderTraitor prioritized bridging assets off Arbitrum faster than swapping out of USD Coin due to Arbitrum Security Council freeze actions

Binance's initial public investigation into its October 29, 2026 hack stated that a compromised DevOps engineer's laptop allowed an attacker to access a service container and execute unauthorized withdrawal transactions

According to Chainalysis data, suspected North Korea-linked cyber operations accounted for nearly 89% of all reported cryptocurrency hack losses in 2026

Following the October 29 Binance hack, the Federal Bureau of Investigation, the United States Secret Service, and the Internal Revenue Service Criminal Investigation unit publicly requested THORChain node operators to block TraderTraitor addresses

As of November 2026, on days following major crypto hacks by the TraderTraitor group, over 99% of transaction volume moving through THORChain has consisted of laundering stolen funds

TraderTraitor received its name from security researchers after the threat group deployed Trojanized crypto trading applications as social engineering malware lures

North Korean cyber threat group TraderTraitor relies on external Chinese-speaking money laundering syndicates to launder cryptocurrency proceeds

TraderTraitor targets developers by conducting multi-round fake job interview processes that require the candidate to run Trojanized coding tests on corporate laptops

During the laundering of the October 29 Binance hack proceeds, the attacker sold approximately $60 million worth of Tether to market makers

According to Chainalysis data, the average loss per suspected North Korea-linked cryptocurrency hack rose from $50 million in 2021 to $185 million in 2026

Endpoint Detection and Response software operates with root system permissions to monitor device behavior and block malware execution

The North Korean cyber threat unit TraderTraitor is designated in cyber threat intelligence tracking as UNC4899

North Korean money laundering networks pass stolen assets through complex webs of intermediary addresses to disrupt transaction monitoring algorithms that calculate wallet taint and exposure

Hardware security modules sign unauthorized transactions if the internal server commanding the hardware security module is compromised