The FBI has claimed that North Korea was responsible for the larceny of approximately $1.5 billion in virtual assets from a cryptocurrency exchange, which is being referred to as the largest heist in history.

The North’s increasing proficiency in cybercrime is underscored by the fact that the haul, which has since shed some of its value, surpassed the previous record sum of $1 billion that Saddam Hussein seized from Iraq’s central bank before the 2003 war.

On Wednesday, the FBI issued a warning that the virtual assets stolen from ByBit, a crypto trading platform based in Dubai, would eventually be converted into currency. The FBI referred to this specific form of North Korean pernicious cyber activity as “TraderTraitor.”

“TraderTraitor actors are converting some of the stolen assets to bitcoin and other virtual assets that are dispersed across thousands of addresses on multiple blockchains at a rapid pace,” stated an FBI statement.

North Korea’s Use of Cryptocurrency Theft to Fund Nuclear Programs

The bureau also anticipated that the assets would be further laundered and subsequently converted to fiat currency, a standard, government-backed currency not linked to commodities like gold.

The Lazarus Group, a sophisticated cybercrime unit operating in North Korea, has been responsible for audacious thefts. The proceeds of these thefts are believed to have been used to finance the regime’s nuclear and ballistic missile programs.

According to a report released in late December, hackers associated with North Korea seized over US$1.3 billion in cryptocurrency in 2024, a record-breaking sum.

Chainalysis, a blockchain analysis firm, reported that the thefts were dispersed across 47 incidents. The total amount was a significant increase from the $660 million that was seized in 2023.

In its report, Chainalysis stated that “Hackers associated with North Korea have become infamous for their sophisticated and relentless tradecraft,” which frequently involves using advanced malware, social engineering, and cryptocurrency theft to finance state-sponsored operations and evade international sanctions.

The proceeds from dozens of suspected cyber-attacks that North Korea conducted between 2017 and 2023, according to UN officials who are monitoring sanctions imposed on the country, were allegedly utilised to enhance its nuclear weapons program.

In recent years, Kim Jong-un has supervised substantial enhancements to North Korea’s capacity to strike distant targets, including the US mainland, even though sanctions have severely impacted his country’s economy, the Covid-19 pandemic, and natural disasters.

The regime generates foreign currency through a variety of methods, including cybercrime. In exchange for cash and technological expertise, Kim Jong-un’s regime has provided troops, ammunition, and weaponry to assist the Russian invasion of Ukraine.

In addition to the approximately 11,000 North Korean troops that are already believed to be in the Russian border region, South Korea’s spy agency alleged on Thursday that Pyongyang had dispatched additional soldiers to Russia, with some being stationed at the frontline in Kursk.

“The Kursk frontlines were the site of the North Korean military’s redeployment after a period of relative inactivity of approximately one month.” An official from the National Intelligence Agency of the South informed Agence France-Presse that “some additional troop deployments appear to have taken place.” The precise scale of the deployments is still being evaluated.

In the past week, North Korea has welcomed a small number of international travellers, including those from the UK, France, and Australia, for the first time since the pandemic. This has provided the country with an additional source of foreign currency.

According to reports, officials are attempting to draw many travellers from China and Russia, some of whom visited last year. Nevertheless, the United States has prohibited citizens from accessing the country since 2017.

ByBit, the most recent victim of a heist, reported that an attacker had seized control of an ether wallet and transmitted the contents to an unidentified address.

The exchange provides access to various cryptocurrencies, such as bitcoin and ether, and serves over 60 million consumers globally. In recent days, Bybit has appealed to the “most brilliant minds” in cybersecurity to assist in recovering the $1.5 billion.