INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

South Korea President Eyes Cybersecurity Task Force After North Korea-Linked Crypto Heist

| 2026-11-03 08:10 CRITICAL HIGH STATE-SPONSORED & ESPIONAGE FRAUD & CRYPTO THEFT CYBERATTACK (GENERAL)
JSON
Executive Summary
AI-generated
The term 'Trayter' emerged when referring to North Korea's hacking activities that resulted in the theft of approximately 1.5 billion dollars worth of cryptocurrencies from the 'Baibit' exchange last year. South Korean President Lee Jae-myung has directed officials to look into creating a cybersecurity task force. The possibility of North Korean involvement in the hacking of the cryptocurrency exchange Binance has been raised, as well as the infiltration of Japanese GMO Internet Group's cloud services and the use of fake IT personnel from North Korean companies targeting US companies.
Technical Mitigations AI-generated
• Account Use Policies (ATT&CK mitigation for Social Engineering): Adds verification for helpdesk resets, approvals, and app consents commonly targeted by impersonation.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
DPRK DPRK EUROPE EUROPE NORTH_AMERICA NORTH_AMERICA educationeducation financefinance technologytechnology cryptocurrencycryptocurrency governmentgovernment energyenergy
Incident Timeline
‎2021 to October 29th this year
North Korea-related cryptocurrency hacking losses worldwide total approximately 13,240,000,000 dollars from 2021 to October 29th this year.
target_region Korea, Democratic People's Republic of
Chainalysis analysis indicates that the total cryptocurrency hacking losses worldwide from 2021 to October 29th this year amount to 22,340,000,000 dollars, with North Korea-related losses accounting for approximately 59% of the total, or 13,240,000,000 dollars.
target_region DPRK
Chainalysis analysis indicates that the total cryptocurrency hacking losses worldwide from 2021 to October 29th this year amount to 22,340,000,000 dollars, with North Korea-related losses accounting for approximately 59% of the total, or 13,240,000,000 dollars.
financial 22,340,000,000 dollars
Chainalysis analysis indicates that the total cryptocurrency hacking losses worldwide from 2021 to October 29th this year amount to 22,340,000,000 dollars, with North Korea-related losses accounting for approximately 59% of the total, or 13,240,000,000 dollars.
general_metric 59 %
Chainalysis analysis indicates that the total cryptocurrency hacking losses worldwide from 2021 to October 29th this year amount to 22,340,000,000 dollars, with North Korea-related losses accounting for approximately 59% of the total, or 13,240,000,000 dollars.
financial 13,240,000,000 dollars
Chainalysis analysis indicates that the total cryptocurrency hacking losses worldwide from 2021 to October 29th this year amount to 22,340,000,000 dollars, with North Korea-related losses accounting for approximately 59% of the total, or 13,240,000,000 dollars.
‎2025/10/31
North Korea's hacking activities, referred to as the 'Trayter' incidents, resulted in the theft of approximately 1.5 billion dollars worth of cryptocurrencies from the Baibit exchange last year.
target_region Korea, Democratic People's Republic of
The term 'Trayter' emerged when referring to North Korea's hacking activities that resulted in the theft of approximately 1.5 billion dollars worth of cryptocurrencies from the 'Baibit' exchange last year.
target_region DPRK
The term 'Trayter' emerged when referring to North Korea's hacking activities that resulted in the theft of approximately 1.5 billion dollars worth of cryptocurrencies from the 'Baibit' exchange last year.
organisation the 'Baibit'
The term 'Trayter' emerged when referring to North Korea's hacking activities that resulted in the theft of approximately 1.5 billion dollars worth of cryptocurrencies from the 'Baibit' exchange last year.
financial 1.5 dollars
The term 'Trayter' emerged when referring to North Korea's hacking activities that resulted in the theft of approximately 1.5 billion dollars worth of cryptocurrencies from the 'Baibit' exchange last year.
‎October 2026
North Korean behind-the-scenes attackers used AI to create fake identities and resumes, and deceive video camera interviews and webcams as part of the 'Lonestar Roundup' operation.
target_region DPRK
The 'Lonestar Roundup' operation, announced by the US Department of Justice and FBI in October 2026, revealed that North Korean behind-the-scenes attackers used AI to create fake identities and resumes, and to deceive video camera interviews and webcams to prevent abnormal behavior.
target_region United States
The 'Lonestar Roundup' operation, announced by the US Department of Justice and FBI in October 2026, revealed that North Korean behind-the-scenes attackers used AI to create fake identities and resumes, and to deceive video camera interviews and webcams to prevent abnormal behavior.
attribution FBI
The 'Lonestar Roundup' operation, announced by the US Department of Justice and FBI in October 2026, revealed that North Korean behind-the-scenes attackers used AI to create fake identities and resumes, and to deceive video camera interviews and webcams to prevent abnormal behavior.
organisation the US Department of Justice
The 'Lonestar Roundup' operation, announced by the US Department of Justice and FBI in October 2026, revealed that North Korean behind-the-scenes attackers used AI to create fake identities and resumes, and to deceive video camera interviews and webcams to prevent abnormal behavior.
‎2026/11/03
North Korea-linked hacking organizations have combined AI and social engineering techniques to escalate cyber attacks.
financial 1.5 dollars
The US Federal Bureau of Investigation (FBI) has attributed a $1,500,000,000 Bithumb cryptocurrency theft incident to a North Korean-linked organization called 'TraderTraitor'.
Employees at Binance, however, were tricked into signing off on the fake transactions, resulting in approximately $1,500,000,000 worth of virtual assets being stolen.
financial 6,300,000,000 dollars
Binance, the world's largest cryptocurrency exchange, revealed on the 30th that hackers stole approximately 6,300,000,000 dollars (around 8,400,000,000,000 won) worth of cryptocurrencies from the exchange.
TRM Rap stated on the 29th that around 6.3 billion dollars worth of cryptocurrencies escaped from the Baibit exchange's own cryptocurrency wallet, with most of the assets moving within a span of 20 minutes.
organisation Eyes Cybersecurity Task Force
South Korea President Eyes Cybersecurity Task Force After North Korea-Linked Crypto Heist.
organisation DataNet
[DataNet] North Korea-linked hacking organizations have combined AI and social engineering techniques to escalate cyber attacks.
organisation GMO Internet Group's
The possibility of North Korean involvement in the hacking of the cryptocurrency exchange Binance has been raised, as well as the infiltration of Japanese GMO Internet Group's cloud services and the use of fake IT personnel from North Korean companies targeting US companies.
organisation Cybersecurity Task Force
Cybersecurity Task Force and North Korea’s Binance Heist
organisation Binance Heist
Cybersecurity Task Force and North Korea’s Binance Heist
infrastructure 1,700 participants
In 2023, North Korean students won first, second, third, and fourth place in a coding competition hosted by a US IT company, which was attended by 1,700 participants.
organisation COVID-19
In particular, the spread of remote work since the COVID-19 pandemic has provided a new source of income for North Korean IT workers who have been using fake jobs to obtain employment with foreign companies.
organisation Mirae Asset Global Investments
The most recent targets were Mirae Asset Global Investments, cryptocurrency exchange Bithumb, and Daishin Securities.
organisation Daishin Securities
The most recent targets were Mirae Asset Global Investments, cryptocurrency exchange Bithumb, and Daishin Securities.
organisation the Korea Media and Communications Commission
Lee told Kim Jong-cheol, chairman of the Korea Media and Communications Commission, to “conduct relevant discussions thoroughly and promptly.”
financial 6 billion
It also comes after the hacking of Binance, the world’s largest crypto exchange, in which more than US$6 billion in cryptocurrency was stolen.
threat_actor Lazarus Group
Those who excel in hacking are given opportunities to study in China and Russia, and after graduation, they join organizations like Lazarus Group and Kim Su-gi, which are under the Reconnaissance General Bureau, and engage in hacking and cryptocurrency trading, playing a crucial role in the development of nuclear and missile technology.
organisation the Reconnaissance General Bureau
Those who excel in hacking are given opportunities to study in China and Russia, and after graduation, they join organizations like Lazarus Group and Kim Su-gi, which are under the Reconnaissance General Bureau, and engage in hacking and cryptocurrency trading, playing a crucial role in the development of nuclear and missile technology.
organisation the Baibit exchange's
TRM Rap stated on the 29th that around 6.3 billion dollars worth of cryptocurrencies escaped from the Baibit exchange's own cryptocurrency wallet, with most of the assets moving within a span of 20 minutes.
organisation the Secret Service
The FBI and the Secret Service are reportedly cooperating on the joint investigation.
organisation the Kim Chaek University of Technology
The country is training IT and hacking personnel at institutions like the Kim Il-sung University and the Kim Chaek University of Technology, which are under the Kim Il-sung Corps and the General Staff of the Korean People's Army.
organisation the Korean People's Army
The country is training IT and hacking personnel at institutions like the Kim Il-sung University and the Kim Chaek University of Technology, which are under the Kim Il-sung Corps and the General Staff of the Korean People's Army.
financial 3 dollars
Baibit stated that 3 billion dollars worth of assets were frozen, and the entire loss would be protected by the company's insurance fund and its own funds.
organisation AWS
A developer's work phone was compromised by phishing and malicious code, allowing the attackers to steal an AWS session token and gain access to the SafeWallet cloud environment.
organisation SafeWallet
A developer's work phone was compromised by phishing and malicious code, allowing the attackers to steal an AWS session token and gain access to the SafeWallet cloud environment.
infrastructure Windows
The attackers exploited this vulnerability to target the 'Windows Virtual Dedicated Server (VPS) service'.
organisation VPS
The attackers exploited this vulnerability to target the 'Windows Virtual Dedicated Server (VPS) service'.
organisation Safe
The attacker targeted the developer of Safe, a wallet solution that provides multi-signature wallets for Bithumb.
organisation GMO Internet Group
The incident involving GMO Internet Group, a Japanese company, is believed to have been caused by a vulnerability in GMO's 'Onama.com Desktop Cloud' service.
organisation GMO
The incident involving GMO Internet Group, a Japanese company, is believed to have been caused by a vulnerability in GMO's 'Onama.com Desktop Cloud' service.
organisation BitBay
BitBay reported that the developers' legitimate work environment and approval procedures were exploited, while Binance acknowledged that an insider's compromised mobile device and withdrawal processing environment were used in the attack.
Tactical Metrics
Metrics
financial
$6B
Stolen Funds
It also comes after the hacking of Binance, the world’s largest crypto exchange, in which more than US$6 billion in cryptocurrency was stolen.
Metrics
financial
1,500,000,000
Dollars
The term 'Trayter' emerged when referring to North Korea's hacking activities that resulted in the theft of approximately 1.5 billion dollars worth of cryptocurrencies from the 'Baibit' exchange last year.
The US Federal Bureau of Investigation (FBI) has attributed a $1,500,000,000 Bithumb cryptocurrency theft incident to a North Korean-linked organization called 'TraderTraitor'.
Employees at Binance, however, were tricked into signing off on the fake transactions, resulting in approximately $1,500,000,000 worth of virtual assets being stolen.
Metrics
financial
22,340,000,000
Dollars
Chainalysis analysis indicates that the total cryptocurrency hacking losses worldwide from 2021 to October 29th this year amount to 22,340,000,000 dollars, with North Korea-related losses accounting for approximately 59% of the total, or 13,240,000,000 dollars.
Metrics
financial
13,240,000,000
Dollars
Chainalysis analysis indicates that the total cryptocurrency hacking losses worldwide from 2021 to October 29th this year amount to 22,340,000,000 dollars, with North Korea-related losses accounting for approximately 59% of the total, or 13,240,000,000 dollars.
Metrics
infrastructure
1,700
Participants
In 2023, North Korean students won first, second, third, and fourth place in a coding competition hosted by a US IT company, which was attended by 1,700 participants.
Metrics
financial
6,300,000,000
Dollars
Binance, the world's largest cryptocurrency exchange, revealed on the 30th that hackers stole approximately 6,300,000,000 dollars (around 8,400,000,000,000 won) worth of cryptocurrencies from the exchange.
TRM Rap stated on the 29th that around 6.3 billion dollars worth of cryptocurrencies escaped from the Baibit exchange's own cryptocurrency wallet, with most of the assets moving within a span of 20 minutes.
Metrics
financial
3,000,000,000
Dollars
Baibit stated that 3 billion dollars worth of assets were frozen, and the entire loss would be protected by the company's insurance fund and its own funds.
Metrics
infrastructure
‎Windows
Affected Product
The attackers exploited this vulnerability to target the 'Windows Virtual Dedicated Server (VPS) service'.
Intelligence Sources
Datanet 2026-11-02
The Cyber Express 2026-11-03
Chosun Politics 2026-10-31