Editor's note: this story was translated from the original VOA Korean article.
Cybersecurity experts tell VOA that the recent North Korean hack of Binance, the world's largest cryptocurrency exchange is particularly concerning because of the speed of both the attack, and how quickly the hackers moved the assets through financial networks.
Michael Barnhart, lead nation-state threat researcher at California-based cybersecurity company DTEX, told VOA that “one of the most significant aspects of the Binance incident was the speed at which the stolen funds were transferred."
"Rather than holding onto the cryptocurrency, the attackers moved it to Chinese money launderers within minutes," he said.
More than $6.3 billion worth of virtual assets were stolen from Binance, the world's largest cryptocurrency exchange, and “about $2.8 billion was frozen before it could be fully laundered or integrated into North Korean control,” Barnhart said. Some $3.5 billion of the stolen cryptocurrency remains in circulation, and efforts to trace and freeze the funds are continuing.
Nick Carlsen is a senior Investigator at TRM Labs who spent 12 years as an intelligence analyst at the FBI initiating major U.S. investigations into North Korea's illicit financial networks. He told VOA in a recent interview the speed and scale of the response to the hack “were unprecedented." He said stablecoin issuers and industry partners moved quickly to freeze substantial assets, but recovering the remaining funds will be difficult because laundering methods have become increasingly complex.
"The stolen funds appeared to have been divided into tens of thousands of transactions, many of them seemingly automated, making them harder to trace," Carlsen said, noting that he expects a substantial portion of the proceeds will ultimately reach the North Korean government, “although the final amount that can be recovered remains uncertain."
Large cryptocurrency exchanges face security challenges because of their size and global reach. Carlsen said exchanges “with thousands of employees have numerous potential entry points for hackers." He said companies handling large amounts of financial assets therefore need multiple layers of security, so that a single compromised account or system cannot expose their holdings.
Analysts also point to the financial objectives behind North Korea’s cyber operations. While Russia and China have often focused on espionage, including the theft of sensitive information and industrial technology, North Korea has increasingly used cyber operations to generate revenue.
“Cybercrime and cryptocurrency theft have become the North Korean government’s largest single source of foreign currency," he said. "The proceeds can be used for a range of government activities, including potentially supporting the country’s nuclear and missile programs."
Barnhart said North Korea has little reason to stop targeting cryptocurrency exchanges.
Previous attacks on platforms including Axie Infinity and Bybit, followed by the Binance breach, show that the sector remains an attractive target. The financial returns remain substantial, while the risks to the North Korean government are comparatively limited.
Both experts said stronger corporate cybersecurity measures are necessary but insufficient to address the threat.
Barnhart argued that “companies can do only so much to defend themselves against repeated attacks without a policy response."
"Governments, particularly the United States and South Korea, must take a more active role in responding to North Korea’s cyber theft operations," added Carlsen.
The Binance breach is part of a series of major cryptocurrency thefts attributed to North Korea. While exchanges continue to strengthen their defenses, the experts say a broader response from governments will be needed to disrupt the networks that move and launder stolen funds.