The $6.3 billion Binance theft, which the FBI and a group of blockchain analytics firms attributed to the North Korean group TraderTraitor — the same group responsible for the $1.5 billion theft from Bybit in February 2025.

But what is truly alarming is not the amount, but the system behind this theft.

North Korea established its cyber unit in 1998, but elevated it to a strategic level after Kim Jong Un came to power in 2013, declaring that cyberwarfare was an "all-purpose sword" alongside nuclear weapons and missiles.

The recruitment system is like an assembly line: it starts at age 11–12, selecting 150–200 children each year to study computer science. At 17, top performers enter the best universities, then a select few join the military cyber unit after further screening. They receive training in cryptocurrency protocols and reverse-engineering foreign devices, as well as advanced mathematics and foreign languages.

The rewards system is straightforward: successful attacks can earn the military unit up to 30% of the stolen profits (in U.S. dollars). Top performers may receive an apartment in Pyongyang of up to 132 square meters, where their parents can live with them too. There are also opportunities to join the Workers' Party or marry into elite families.

📌 Lessons learned (what matters to you):

1️⃣ The threat is not “individual hackers,” but “an entire state.” Individuals may stop after they are caught, but the state continues. TraderTraitor targets “people,” not “code” — a fake job offer, a malicious software file, one point of entry is enough. This means that even if your technology is strong, as long as you are human, you can be targeted.

2️⃣ What this means for ordinary users. Major attacks target platforms, but both platforms and users bear the consequences. Binance confirmed that it covered 90% of the losses with its own funds, but market confidence took a hit. Your assets are not just in your wallet; they also depend on the security infrastructure of the platform you use.

3️⃣ The practical takeaway: Don’t trust any “job offer” or “technical test” that asks you to run unfamiliar commands. Use two-factor authentication (2FA), avoid clicking suspicious links, and keep large amounts of assets in cold wallets. If the platform itself is vulnerable to hacking, don’t rely entirely on “the platform’s security.”

💬 Your question: Do you think state-sponsored attacks like these will lead more people to choose self-custody? Or will the opposite happen — will people rely more on large platforms because they can’t protect themselves?

👇 Share your opinion in the comments

#Write2Earn #علي_ابوماهر #Binance #Crypto #Security