North Korea’s Crypto Thefts Pay for Its Weapons While the UN Panel That Tracked Them Stays Shut

North Korea’s theft of cryptocurrency is a state revenue programme run by its main intelligence agency to pay for nuclear weapons and ballistic missiles, according to a report by eleven governments that took over the monitoring work of a United Nations panel Russia shut down in 2024. On Thursday 29 October, analysts say, it carried out the largest crypto theft on record.

About $6.36 billion was moved out of wallets belonging to Binance, the largest crypto exchange, across ten blockchains, most of it in about 20 minutes, according to TRM Labs, a blockchain analytics firm, which attributes the theft “with high confidence” to a North Korean unit called TraderTraitor. That attribution is a private company’s. As of Sunday no government had published one: the FBI’s public service announcements list nothing on Binance.

Who in North Korea does the stealing?

The Reconnaissance General Bureau, the countrythe military intelligence agency already under a UN asset freezersquo;s primary foreign intelligence organisation, already under a UN asset freeze. The Multilateral Sanctions Monitoring Team, whose members are Australia, Canada, France, Germany, Italy, Japan, the Netherlands, New Zealand, South Korea, the United Kingdom and the United States, placed the revenue-raising hacking groups under the bureau’s 110 Research Institute in its October 2025 report. Four groups sit there, it says, and “Lazarus Group” is the loose public name for all four. Two of them, TraderTraitor and CryptoCore, grew out of a crypto-theft team the bureau set up in 2016 and 2017; their work was once filed under the labels APT38 and BlueNoroff.

TraderTraitor is the one that matters here. The report credits it with about $2.58 billion stolen between January 2024 and September 2025, including the February 2025 theft from Bybit, which the FBI attributed to the same unit five days after it happened. Security vendors give these groups other names; the report lists Jade Sleet and UNC4899 as aliases for TraderTraitor.

What do governments say the money pays for?

Weapons, and in large part. In its final report in March 2024, the UN Panel of Experts recorded one member state’s estimate that cyber operations generate about 50 per cent of North Korea’s foreign currency income, and another’s that 40 per cent of its weapons of mass destruction programmes are funded by illicit cyber means, according to document S/2024/215. The monitoring team went further in 2025: crypto heists, together with arms sales to Russia, accounted for the majority of the country’s foreign currency earnings in 2024, and probably let it earn more than before the expanded UN sanctions of 2016 and 2017.

Those are government estimates, and they are attributed as such. The table below sets out what each official body has found, and what it says the money is for.

The following table is this publication’s compilation from the documents named; periods and methods differ, and the figures should not be added together.

The sources also disagree on Bybit: the monitoring team puts it at $1.4 billion, the FBI at about $1.5 billion. By our arithmetic, the Binance figure is 3.1 times the $2.02 billion that Chainalysis attributed to North Korea for the whole of 2025, and eight to fourteen times what the monitoring team says the state’s overseas labourers earned for it in the same year. Tallies circulating this week of incidents since 2016, and of a 2026 year-to-date total, could not be traced to a primary source and are not used here.

Why is a coalition doing the UN’s monitoring?

Because the Security Council stopped. Russia vetoed the renewal of the Panel of Experts in March 2024 and the panel disbanded that April. The eleven governments formed the monitoring team in Seoul in October 2024; it has published three reports since, the third, on overseas labour, in September, which it then circulated as a Security Council document, S/2026/745. Its statements ask the Council to re-establish the panel “in the same strength and structure it had prior to its disbandment.” The obligations themselves never lapsed. The asset freeze in Resolution 1718 still binds every member state, the bureau has been on the list it covers since 2016, and the monitoring team reads that freeze as reaching cryptocurrency.

What lapsed was a shared finding. A coalition report carries the authority of its authors, not of the Council, and the countries that host most of the laundering networks and workers it names, China and Russia among them, are not members of it.

What has Washington actually done?

Mostly designations and seizures aimed at the people around the hackers rather than the hackers. Treasury has issued eight DPRK-related sanctions announcements since January 2025, by this publication’s count of its press releases, most of them on IT-worker networks. In November 2025 it designated eight bankers and two institutions for laundering cybercrime and IT-worker proceeds, and its under secretary, John K. Hurley, said North Korean hackers “steal and launder money to fund the regime’s nuclear weapons program.” The most recent action, on 28 October, named ten individuals and one entity, most of them in Russia, the day before the Binance theft. In June 2025 the Justice Department announced searches of 29 suspected laptop farms in 16 states and the seizure of 29 financial accounts.

The tools work on the edges of the system: the facilitator, the bank, the stablecoin issuer that can freeze a token. They do not reach Pyongyang. The broader limits of that approach are ones this publication has examined before, and the European Union’s latest North Korea listings, covered here in October, rest on the same UN grounds. A designation names a person. The Binance theft, if the attribution holds, was carried out by an agency the Security Council placed under an asset freeze ten years ago.