Intelligence Scoop: How North Korean Hackers Stole $6.3bn in Crypto

Did North Korean hackers just get away with the biggest heist in history? And why does Kim Jong Un run his intelligence agencies like crime syndicates? Listen as David and Gordon delve into the mad world of North Korean hackers and crypto heists and explore how you steal $6.3bn in 20 minutes, and then use it to make nuclear weapons. ------------------- Sign-up for our free newsletter where producer Becki takes you behind the scenes of the show: therestisclassified.com/newsletter ------------------- Join the Declassified Club to go deeper into the world of espionage with exclusive Q&As, interviews with top intelligence insiders, regular livestreams, ad-free listening, early access to episodes and live show tickets, and weekly deep dives into original spy stories. Members also get curated reading lists, special book discounts, prize draws, and access to our private chat community. Just click here or join on Apple Podcasts. ------------------- Get a 10% discount on business PCs, printers and accessories using the code TRIC10. Visit ⁠⁠⁠⁠https://HP.com/CLASSIFIED⁠⁠⁠⁠ for more information. T&C's apply. ------------------- Email: ⁠⁠⁠⁠⁠[email protected]⁠⁠⁠ Instagram: ⁠⁠⁠⁠⁠⁠⁠⁠@restisclassified⁠ Video Editor: Joe Pettit Social Producer: Emma Jackson Assistant Producer: Alfie Rowe Producer: Becki Hills Head of History: Dom Johnson Exec Producer: Tony Pastor Learn more about your ad choices. Visit podcastchoices.com/adchoices

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:03David McCloskey?

  For exclusive interviews, bonus episodes, ad-free listening, early access to series, first look at live show tickets, a weekly newsletter, and discounted books, join the Declassified Club at therestisclassified.com.

• 0:25David McCloskey?

  Did North Korean hackers just get away with the biggest heist in history? And why does Kim Jong-un run his intelligence agencies like crime syndicates? Well, welcome to The Rest Is Classified. I'm David McCloskey.

• 0:37Gordon Corera?

  And I'm Gordon Corera.

• 0:38David McCloskey?

  And this time, we are going to be looking at how you steal $6.3 billion in 20 minutes and then use it to make nuclear weapons. Yes, it is the mad world of North Korean hackers and crypto heists.

• 0:52Gordon Corera?

  That's right. Last week, we looked at preppers and recommended keeping some cash under your bed. Unfortunately, David, you keep yours in crypto, so you're now funding the North Korean nuclear and missile programme, which is sad, I guess.

• 1:03David McCloskey?

  Ah, it's very sad. Sad times.

• 1:05Gordon Corera?

  I also checked, and $6.3 billion in hundred-dollar bills would require 6,000 of those attaché cases that you see in the films to carry away all the loot. So we're going to be looking at how they did it and also the worst job interview in the world, I think.

• 1:22David McCloskey?

  So this time, we'll be looking at how this very Ocean's Eleven-style heist went down and crucially, explain how it all ties back to the hermit kingdom of North Korea and the crazy way that they put their spies and hackers to work. So let's begin this story of the heist with the victim. But first, a word from our sponsors, HP.

• 1:46Gordon Corera?

  This episode is brought to you by HP.

• 1:49David McCloskey?

  In intelligence, you quickly learn that you are only as strong as the network around you. It's rarely a single major event that undermines an operation. It's the gaps between systems. That's where information leaks.

• 2:00Gordon Corera?

  It's the same in business. Leaders face a constant battle against strict timelines, mismatched tools, and the worry their security isn't as tight as they think it is.

• 2:12David McCloskey?

  Which is why HP approaches technology not as a collection of gadgets, but as an integrated system.

• 2:17Gordon Corera?

  And crucially, that protection is built in at hardware level. It runs quietly in the background, blocking threats without requiring constant specialist oversight.

• 2:27David McCloskey?

  With a team of business advisers, HP helps businesses of all sizes find technology that fits their needs and budget.

• 2:35Gordon Corera?

  To see how HP helps businesses work securely and productively, visit hp.com/classified. Trick listeners also benefit from 10% off HP Business Technology with the code TRICK10.

• 2:52Speaker 02

  Hi, this is Gary Lineker from Goalhangers. The rest is football. This episode is brought to you by Wise. It's only when you start moving money between currencies that you really think about the exchange rate, the fee, and what might be hidden away in the small print. Whether you're living abroad, paying someone overseas, or just trying to manage your money across borders, you want a fair exchange rate, an easy transfer, and no surprises along the way. Wise keeps things simple. Wise is a smart way to move the currencies you need around the globe. It works in more than 160 countries and with over 40 currencies. Most transfers arrive instantly. Wise uses the mid-market exchange rate, like the one you see on Google, with no markups or hidden fees.

• 3:36Speaker 02

  So when money needs to move, you can see the rate, know the fee, and get on with it. Join millions saving billions on hidden fees by downloading the Wise app today. Be smart, get wise. Ts and Cs apply.

• 3:50Speaker 03

  This episode is brought to you by Petivity. Cat parents are basically mealtime detectives. Who actually ate? Did they finish? Was that less than yesterday? The new Petivity Smart Feeder for cats turns everyday meals into meaningful health insights, helping you identify changes in your cat's habits and be more proactive about their health. Plus, you can feed them from anywhere. Take the mystery out of mealtime. Visit petivity.com, P-E-T-I-V-I-T-Y.com/catfeeder to learn more.

• 4:20David McCloskey?

  So the victim of this heist is Binance, which is the world's largest cryptocurrency exchange. But before we get into the victim more deeply, it's probably worth setting up just briefly crypto. What was actually stolen?

• 4:37Gordon Corera?

  So crypto is digital currency, which exists in ones and zeros. Most famous is Bitcoin. It can be moved quickly and anonymously. And the point about it is that it was set up to be decentralized and free from state control, things like central banks. There is a risk that if you keep it in your own digital wallet, the details of your crypto, and you lose your password or your computer, it's gone. There's a famous story of a guy from Newport in Britain whose girlfriend mistakenly threw away his computer in 2013, which had 8,000 Bitcoins on it, worth about $650 million today. And it went into a landfill, and he's been trying to get it back ever since. So that's one of the risks of crypto.

• 5:20Gordon Corera?

  One of the safer things to do is to store it somewhere, like a digital exchange. They're also the places where you can trade it and buy and sell different types of digital currencies. They're not quite like a bank, even though they sound like one, because they're not regulated or protected in the same way. But Binance is the biggest and most important of these digital currency exchanges.

• 5:44David McCloskey?

  And to your point on differences with a bank, the transactions are, for the most part, not reversible, which is also going to be an important part of this. So Binance, crypto exchange, kind of like a bank, but not really. Now, let's maybe set up Binance a bit. So it's founded in 2017. It is one of the most important crypto exchanges. And it is estimated that Binance holds about $170 billion in assets and trades about $95 billion worth of crypto every day. I did look this up. Those numbers, of course, sound large. If you compare the assets, though, to a really big US bank, it's pretty tiny.

• 6:28David McCloskey?

  But if you compare the trading volume, it's quite significant, which I think is going to be an important part of this story as well. So there's, in terms of dollars or value that Binance holds, it's not particularly massive when you compare it to Bank of America or JP Morgan. But when you look at the volume of movement, the trade volume, it's quite high.

• 6:47Gordon Corera?

  Yeah, that's right. And Binance was founded by Changpeng Zhao, known as CZ. And originally, it was founded in China. But then it was moved, and it's a decentralized company to some extent, with its leadership based in lots of places around the world. That's the whole crypto ideology. You're not under one state. Now, CZ pleads guilty to money laundering in 2023, and Binance pays a massive $4.3 billion fine to the US government, basically for letting criminals, terrorists, and sanctioned states use the platform. Because, of course, one of the advantages of crypto, because, as we said, it's pretty anonymous, means those kind of bad guys want to use it. He actually served a four-month prison sentence,

• 7:31Gordon Corera?

  but then was pardoned by President Trump. And he's still the major shareholder, although he technically doesn't run the company anymore. So that's the key figure inside Binance.

• 7:43David McCloskey?

  And Binance had helped facilitate, fun fact, a $2 billion investment in World Liberty Financial, which is the crypto company that had been launched by Trump and his sons exactly at the time when Binance was lobbying for the pardon.

• 7:55Gordon Corera?

  What a coincidence.

• 7:56David McCloskey?

  A fun fact, unrelated to the heist, but still worth the wait. I think there's a great quote from Willie Sutton, the famous bank robber, who's asked in the 1930s why he robs banks. And he says, because that's where the money is. And it is true now that these crypto exchanges increasingly have a lot of the money.

• 8:20Gordon Corera?

  That's right. I did discover, I was looking into Willie Sutton, and on the FBI page, it says he actually wrote an autobiography called Where the Money Is, or Where the Money Was. Love the idea of a bank robber who writes his autobiography, referencing his best quote. But you're right. In the old days, he would be a traditional bank robber. But we're going to look at a very modern heist and a very digital heist.

• 8:41David McCloskey?

  So let's set up what happened.

• 8:43Gordon Corera?

  So just after 8:00 PM London time, 4:00 PM Eastern time in the US, October 29, massive amounts of money start to move out of Binance's hot wallets. And these are the wallets which are connected to the internet and people can trade off. And the crucial thing is the speed of this. This is happening really fast. But it's also, because of the way the ledger works, it's public. So even though it's anonymous, who's doing what? You can see money move from wallets and moving in and out, and in this case, out of Binance. So of course, they're seeing a massive flow of money, and there's total panic inside the company. They set up a war room. But it's interesting, because they're so dispersed, you've got 100 people on a screen

• 9:28Gordon Corera?

  in a massive video conference call, according to the reports. Some are in Abu Dhabi, some are in Hong Kong. They're talking in Chinese, they're talking in English, they're kind of muting, they're unmuting.

• 9:38David McCloskey?

  They have no headquarters, right?

• 9:40Gordon Corera?

  Yeah.

• 9:40David McCloskey?

  The company has no actual headquarters. It's hard to.

• 9:44Gordon Corera?

  Hard to coordinate. And then the problem is, you can imagine these people are watching, literally in real time, as billions are being stolen from their company. So it is like watching on CCTV as robbers are taking bags of money out of your vault of your bank, Willie Sutton-style.

• 10:04David McCloskey?

  So how did they do it? I mean, I think this is the big question, is how the world did these hackers? We'll come to who they are and abid it. But how did they actually pull this off? How did they get inside the crypto vault, as it were?

• 10:18Gordon Corera?

  It's really high-end and really fascinating. So it starts way back in June, when an engineer who works on the wallets that hold crypto downloaded a tampered piece of software after just looking for a bit of software on a search engine. That's first mistake.

• 10:36David McCloskey?

  These all start the same way. Every one of these hacking stories we've done is someone downloads something or clicks a link, right? It's crazy.

• 10:43Gordon Corera?

  Now, what's interesting is the security team at Binance spot this, and they replace his laptop and change his passwords. But it meant that the hackers, and we'll come to who they are, had identified someone who worked on the wallets and who had access to the engineering around the wallets. Then, the next stage, this is the crazy bit. September, a different engineer is contacted through a legitimate job hunting platform. And his profile says he works at Binance by someone posing as a project director. And there's a first round interview with an HR representative. And then comes a second round interview.

• 11:23Gordon Corera?

  So this guy thinks he's doing well, who claims to be the CEO of the company recruiting him or trying to recruit him, except it's not real.

• 11:31David McCloskey?

  Do we know yet what the cover name of this company was? Cause I do think if you're sitting for an interview, you would presumably do some research on the company that you were being interviewed for, right? Like, so did this, this engineer just hadn't done that? Or that had the, had the hackers set up like a, a website to make the company seem real? Maybe we don't know yet.

• 11:53Gordon Corera?

  For a moment though, I thought it was because maybe you were worried you just had a job interview, you just wanted to double check it wasn't the North Koreans.

• 12:01David McCloskey?

  I've been doing all these job interviews with companies. They just, things come to me and I just, I just accept the Zoom, the Zoom calendar invite and you know, just roll with it. No, but I mean, how did they, was there a cover for this or was it just?

• 12:13Gordon Corera?

  They must've done a pretty good cover. I mean, it is true that the North Koreans have been perfecting this strategy for a while. So they've done things like putting their own fake IT workers into real companies and then they use it to steal money or to get information. But they've also been running these fake interviews for real workers to try and track them. So in this case, what we know is in the first round interview, the HR representative conducts a live video interview with the engineer. So it's a proper conversation and the interviewer shares a social media account with them, including, you know, personal photos and videos on the platform to build trust. But then the second interview, which is with the CEO, is conducted in a, a social chat app. That's all they'll say, Binance, we don't know which one.

• 12:57Gordon Corera?

  And near the end of the interview, here's the, here's the crucial tell. The job applicant, the engineer at Binance is instructed to download an assignment, which unfortunately contains very high end malicious code and goes to work on his work computer very stealthily.

• 13:16David McCloskey?

  He does the interview on his work computer?

• 13:20Gordon Corera?

  Yeah, that looks like part of the problem, I think. And we've seen this before where people have done these interviews and they download stuff and it's to steal the keys to their own personal crypto wallet so that, you know, some hacker can empty their crypto account. But why just steal one wallet when you can get keys to the vault? Because what the hackers then do on October the 20th is use that compromised computer from the job interview person, plus an internal tool, an AI tool inside Binance to reach the computer of the first engineer, the one back in June. He's the person, or she's the person who develops the wallets and structures them. So they get hold of their access and someone else's.

• 14:04Gordon Corera?

  And now they have high end access to the way the crypto wallets sign to move money. They're inside the system. Nine days later, October 29th, they use that to strike and move the money.

• 14:17David McCloskey?

  So it's obviously planned over, over months. And I think, you know, we, we mentioned the Ocean's Eleven parallel upfront, that the, the reconnaissance and the planning and having everything in the right position, having the timeline worked out, that is, that is the hard work. The actual heist can happen quite quickly. One of the fascinating pieces about this is the speed, right? It is the speed with which they've moved everything and the way that they fragmented the crypto through multiple wallets and accounts and, and back and forth. Was that?

• 14:51Gordon Corera?

  Yeah.

• 14:52David McCloskey?

  AI powered or do we know yet?

• 14:55Gordon Corera?

  Possibly a bit, a possibly a bit, because you're right. The crucial bit is, once they're in, they've got access to move money, they've got to do it fast because Binance will see it happening. Everyone's going to see it happening because it's public. And so immediately you're in a race against time because Binance can reach out to other exchanges where some of that money is being moved into and ask them to freeze any money coming into them from Binance. So about half of the money actually gets frozen because it's moved to other exchanges who agree to freeze it. But a lot of the rest of the money is moving to other exchanges, decentralized exchanges, where you can't freeze the money. So about half at least goes to those places. And the crucial thing is the speed at which they act, because it looks like they might

• 15:39Gordon Corera?

  have used AI, not so much to get in, in the first place, but to speed up this process of moving the money. Cause there's a blockchain security company, Chain Analysis, who said that they shuffled money in and out of wallets at an amazing speed, which suggests automation. So Elliptic, which is another really interesting company, which tracks these movements, says the hackers used about 12,000 wallets across 11 different of these blockchains and did 40,000 transactions to shuffle the funds to new wallets. Like every 25 seconds, you're just moving the money constantly and circulating it, sometimes back and forth through the same address, basically to cause confusion.

• 16:21Gordon Corera?

  Because if you're trying to stop the money, you've got to work out, well, where is it at this moment? Who do I contact? What's the stolen money and try and freeze it before it's moved through the system? And they were doing this so fast that that was really, really hard to do. So that's one of the high end things about this.

• 16:38David McCloskey?

  Do we know yet what the actual sort of cyber weapon or the, the malware was that ended up on the, on the computers at Binance? Or is that still being unpacked by Binance and other cybersecurity firms?

• 16:55Gordon Corera?

  Well, we don't know. I mean, they said it was kind of high end, zero day malware. We don't know the exact type, but it was clearly, you know, this is stuff which is highly engineered and where the time spent putting this operation together is significant. This is not some hacker, you know, lone hacker using AI or something else could do. It's just not possible.

• 17:16David McCloskey?

  The comparison that it, it drew my mind to was the Bangladesh Central Bank heist, which happened in 2016. And the fascinating thing about that was the, the way that the, the way that the North Korean hackers got the money out of the bank and then started to move it, they had to go through, you know, correspondent bank accounts to try to move it eventually, I think, you know, to Singapore where they could wash it through casinos. Here you have a supercharged version of that, where instead of moving it four or five steps through a kind of correspondent banking system to try to outrun the freezing of those accounts, you have this just, you know, every four seconds back and forth move through a completely

• 18:00David McCloskey?

  deregulated, decentralized system that is much more efficient for, I mean, essentially stealing and then laundering money. It's really amazing how, how 10 years later, the, the speed of this and the volume you can move is just so much, it's so much bigger.

• 18:19Gordon Corera?

  I mean, that's right, because that Bangladesh bank heist, they tried to steal a billion dollars and I think they got, got away with about 81 million in the end. This time they tried to steal 6.3 billion. And as I said, like maybe about three billion or so gets frozen, but you still get at least, it looks like they got three billion dollars at least out themselves, which then what's so interesting is, is, is offloading it. And I was talking to Jeff White, who's a journalist who did a series and wrote a book called The Lazarus Heist, and who spent time trying to trace actually what happens to some of this money. And, you know, he thinks immediately, quite quickly, you'll get the hackers selling off, say three billion for two billion.

• 19:01Gordon Corera?

  You sell it off at a discount to people who are then going to trade it into people who want to buy crypto, maybe particularly around Asia. Again, they'll buy it at discount because it's kind of gray market, it's being washed. And eventually it may, it will get laundered out, perhaps as we talked before, through different places and even kind of casinos, as happened with Bangladesh. But this will have happened really fast and much faster. And actually the hackers will have offloaded and got their payout very quickly in this case. So it's a really kind of well organized money laundering network that's been built up around, around these crypto heists. And I think the reality is in this case, they got away with a lot.

• 19:38David McCloskey?

  But who is making the money and who will benefit? Enter the North Koreans. So come back after the break and we will dive deep into the crazy world of North Korean hacking.

• 19:51Speaker 04

  Shaq here. What's it like to buy a car from Carvana 100% online and get it delivered to your door? Let me tell you. Your car is here, Mr. Shaq. Thank you, Mr. Carvana guy. Can't wait to take it for a spin. Only the best for you, Mr. Shaq. Hey, have you always been so big, tall and handsome? Not always. I was 16 once. Seven days to love it or return it, Mr. Shaq. Not that I would. You never do. No, I never do. So buy your car today on Carvana. Delivery fees may apply. See our seven day return policy at carvana.com.

• 20:21Speaker 05

  Host Thanksgiving with industry leading quality standards from Whole Foods Market. There are no antibiotics in their meat department ever, so carve up turkey and spiral cut ham with peace of mind. Shop organic sides like stuffing mix and cranberry sauce from 365 brand. And guess what? All their delectable pies are made with no high fructose corn syrup. Gourmet Thanksgiving flavors with the quality you want, only at Whole Foods Market.

• 20:50Speaker 04

  Prize picks packs are here. Rip digital packs and get real basketball, footfall and Pokemon cards on prize picks packs. Available now nationwide. Once you see your pool, you have a choice to sell back instantly for real cash or ship at home. Cash from your sale will immediately be added to your prize picks balance. It's just another way to run your game. New users, download the prize picks app today and use code SPOTIFY to get $25 instantly in bonus packs when you buy your first $5 pack. Prize picks, run your game. 18 plus in eligible areas. Terms apply. Collect responsibly.

• 21:25David McCloskey?

  Well, welcome back. So Gordon, how do we know that it's the North Koreans? Because obviously they haven't claimed credit for this yet.

• 21:33Gordon Corera?

  No, in fact, they've denied it. But within a couple of days, the FBI pointed the finger, not just at the North Koreans, but a particular group who are called Trader Traitor, which is pretty, pretty good, I think, in cyber names, don't you think? I mean, it's not bad.

• 21:47David McCloskey?

  It's not bad. It's not. My personal favorite is the Beagle Boys, which were a hacking group.

• 21:53Gordon Corera?

  90s pop band?

• 21:55David McCloskey?

  Not, not a 90s pop band, but a hacking group we encountered who had been, I think, I think it involved in some of the hacks prior to the Bangladesh Central Bank heist. So the Beagle Boys may have been subsumed by Trader Traitor, for all we know.

• 22:10Gordon Corera?

  Yeah, Trader Traitor are good, I think. So the FBI immediately said it had seen them converting some of the stolen money into another cryptocurrency and was asking people to block addresses. Binance itself says that it's detected and prevented 57 suspected North Korea-linked cyber threat cases, including other fraudulent job interviews, malicious software, all these kind of things.

• 22:32David McCloskey?

  So Binance is 57 for 58 in preventing the North Koreans from getting inside. Oops.

• 22:39Gordon Corera?

  The one that goes wrong.

• 22:40David McCloskey?

  The one that got away. That's right.

• 22:42Gordon Corera?

  Gosh, your billions. But I guess it was always going to be them. Because we talked, didn't we, before the break about the Bangladesh bank heist? And I mean, I find it really interesting because there they were going after central banks because, Willie Sutton style, that's where the money was. But pretty soon after that, 2016 was that heist, they move into crypto because everyone's moving into crypto because that's where the money is. So it kind of makes sense that they move that way. And in recent years, we've seen lots of these hacks from Trader Traitor specifically. 2025, they stole 1.5 billion from a cryptocurrency exchange, Bybit, which until now was the biggest. And they tricked the CEO then into authorizing a seemingly routine transaction that handed

• 23:24Gordon Corera?

  them control of the exchange's system. Oops. And there's other big hacks as well. $308 million from a Japanese exchange in 2024, 235 million from an Indian one soon after. So Trader Traitor definitely have serious form in this, and they are thought to be linked, of course, not just to any old criminals, but to North Korean intelligence and the reconnaissance general bureau.

• 23:51David McCloskey?

  Which is, I think, you know, one of the better, maybe a more anodyne spy agency name that really masks the insanity and piratical nature that is inbred in the reconnaissance general bureau. And I think it's, it's worth, it's worth setting up the North Korean context a bit because that is where these, these attacks come from. North Korea is, it's kind of its own bird, isn't it, Gordon? Because it is a state that uses its spies, quote unquote, sort of scare quotes, to essentially act as criminals to go out and fund its military

• 24:31David McCloskey?

  programs and its security services. And it all really does stem from being a relatively poor, although we should talk about how North Korea has changed a bit over the last few years, but a relatively poor, cut off kind of hermit kingdom run by a ruler, Kim Jong Un, who knows that he doesn't just need Dennis Rodman and basketball to survive, Gordon, he needs nuclear weapons and ballistic missiles.

• 24:56Gordon Corera?

  That's right. And we did, we did do the Bangladesh bank heist a couple of years back, didn't we, on the show? And it might be worth, if people are really interested in diving deep into Dennis Rodman specifically, and the, the general bureau and who they are, we're worth going back to those episodes. But there was also a very good report by this organization, Detex, which says, "At its core, North Korea's cyber program functions more like a state-sanctioned crime syndicate than a conventional military or intelligence apparatus." That's the key point, is their intelligence agencies are basically criminal hackers for the state.

• 25:30David McCloskey?

  Could the RGB, Gordon, be a friend of the pod of the show? Because they have quite the CV. I mean, if you go back, I mean, this is an agency or a bureau that has kidnapped Japanese citizens and rendered them to North Korea to serve as language instructors. They've blown up a Korean air airliner, killing over 100 people. That was back in the 80s. They sunk a South Korean ship in 2010, killed almost 50 South Korean sailors. That was done by an RGB mini-sub. My favorite, they assassinated Kim Jong Un's half-brother in the Kuala Lumpur airport with a nerve agent. This is insane. It's like, maybe we should do this story all on its own at some point, by convincing two women totally unaffiliated

• 26:15David McCloskey?

  with the North Korean intelligence agencies that they were part of a prank. And they went up to him and smeared binary nerve agent on him that, when it was combined, killed him as VX. And they also, lastly, the RGB has a department called the Enemy Collapse Sabotage Bureau.

• 26:33Gordon Corera?

  They are thought to be at least 8,000 state hackers working for North Korea. And it's really interesting, isn't it? Because they recruit young maths and IT students. And when I say young, I mean, really young. I mean, they identify people at elementary or primary school level, and they put them in the pipeline for this program. And depending on how good you are, you can end up in almost like factory work, doing the hacking, or the best get put into the elite hacking teams of the bureau.

• 27:00David McCloskey?

  The Beagle Boys.

• 27:01Gordon Corera?

  The Beagle Boys. And, you know, the incentives for them are quite strong because if you get into that elite hacking team, you can lead a much better lifestyle, you know, enough perhaps to be able to go spend time abroad in China or elsewhere in Asia where they sometimes operate. So the incentives are pretty strong to get into these hacking teams and to recruit the absolute best people. So the absolute best students will be taken and putting into these teams. And then, the point is, they make money for the state. I mean, they're a core part of the state apparatus. I mean, in all, TRM labs estimate that North Korean hackers have stolen $12.8 billion in cryptocurrency, over more than 100 incidents in the last, you know, 10 years or so, and that they're responsible

• 27:46Gordon Corera?

  for 89% of all crypto hack losses in 2026. So, you know, they are basically, the, the core of hacking all crypto around the world is coming from these North Korean state hackers.

• 28:00David McCloskey?

  And if they have taken almost $13 billion over roughly the last decade, if that $3 billion from the Binance heist holds, I mean, they'll have gotten nearly a quarter of their haul over the last decade in about 20 minutes.

• 28:16Gordon Corera?

  Yeah.

• 28:16David McCloskey?

  It is absolutely remarkable. Now, this is, I mean, this is the key point with North Korea is, they're not just stealing this money for fun. The state, the North Korean state, needs about $6 billion a year. So these kind of criminal operations are a very significant portion of its income. And it's income that the North Korean state hard currency, it could convert this into hard currency as sort of it moves down the line. That's hard for the, for the North Korean government to get. And it's thought that roughly 50% of North Korea's currency funding for purchasing components, largely for and for its ballistic missile programs, is now supplied by these cyber heists, which is, which is wild.

• 28:58Gordon Corera?

  Can you imagine what it was like in the operations room of these hackers when they're watching the money come out? As someone said, it's like the end of Ocean's 11, where, you know, the fountains of the Bellagio in Las Vegas go up and they're all kind of standing there going, "Good job, guys." Because you've just got a significant chunk of your state's income for the year to make nuclear weapons and missiles to fire them against the West, I mean, just in one heist.

• 29:23David McCloskey?

  Except in this case, I think you might, instead of the Bellagio fountains, as you're seeing, you have a bunch of guys probably sitting in Cheeto-stained gamer chairs, working on energy drinks and Pop-Tarts and screaming at screens, which is, you know, if you're looking to adapt this story, it's potentially a bit less cinematic than Ocean's 11. But the image that we have of hackers here, of like a guy who's sitting in his mom's basement with, you know, computers and hardware everywhere, and, you know, it's, it's like, that's not what we have here. This is an industrial operation. And so there's real structure and planning that goes into these. It's not five or six guys who are

• 30:05David McCloskey?

  sitting in a room. This is, this is a state level, this is like if you took... You know, if you took the CIA or you took MI6 and you said your job is now not to go out and collect a whole bunch of intelligence on the world, but to go out and actually commit crimes and to steal things all over the planet, that that is what has happened here. The entire sort of industrial hacking capacity of the North Korean state is directed outward at these criminal enterprises. So these guys are probably sitting in, you know, a big office building somewhere and it probably has a bit of an operational flow to it. Although I think there probably are pop tarts, don't you think so?

• 30:40Gordon Corera?

  Yeah, and they probably get a medal. But we should, we should note, David, that North Korea has denied any role in this. A sister of North Korea's leader, Kim Jong-un, she responded to allegations and said they were a trite provocation. This is a sinister attempt to damage the international image of the DPRK, North Korea, and undermine its dignity and international prestige, she said. So there you go. That's that then.

• 31:05David McCloskey?

  You always, you always do feel the urge, Gordon, don't you? I think it's the journalist in you to report, to faithfully report the denials from what I would describe as obviously guilty parties on our program.

• 31:19Gordon Corera?

  I'll let the state collapse bureau or sabotage bureau come after you then.

• 31:24David McCloskey?

  The enemy collapse sabotage bureau.

• 31:26Gordon Corera?

  That's the one, yeah. So I guess what does it all mean? I mean, where's your crypto, David? Is it safe? That's the big question.

• 31:32David McCloskey?

  Well, the question I do have, and we haven't talked about this, this piece of the hack, but I'm just thinking about it curious right now, is how do they convert it to hard currency?

• 31:43Gordon Corera?

  Yeah. I mean, I think it's laundered through enough stages that eventually you can do that. I mean, whether they have to do it at casinos or, because that's how they did it in Bangladesh, do you remember?

• 31:53David McCloskey?

  Yeah.

• 31:54Gordon Corera?

  They washed it through casinos. So whether at some point you have to, I mean, you have to turn it into, into currency somehow. So if anyone, if anyone out there knows, if anyone out there is a money launderer who, you know, works in crypto and washes it for the North Koreans, just, the rest is classified at goalhanger.com, drop us a line and explain, because we'd be interested to know.

• 32:15David McCloskey?

  I guess, I guess, once you have moved it sufficiently so it is washed and you have it, you could, you could in theory, I suppose.

• 32:22Gordon Corera?

  You can cash it out like anyone else does.

• 32:23David McCloskey?

  Put it, put it into another exchange and then, and then cash it out. But it would be obviously in small, in small chunks over, over time.

• 32:31Gordon Corera?

  But we should say that Binance initially stopped all its customer withdrawals, then restarted them. It says it's going to pay all the customer losses out of its own pockets from a special reserve fund. I mean, it's interesting because, because they're not a bank, they're not regulated in the way and protected. Your deposits aren't protected in the same way. But of course, they've got to do that because otherwise confidence, not just in their exchange, but in, you know, crypto generally kind of takes a knock. So individual customers have not lost their money. But the reality of this is there's going to be a lot more of these, you know, crypto heists because it's where the money is. So I think, you know, the answer is you've got to be careful. If you get asked, David, for a job interview, check your crypto wallet afterwards, I think.

• 33:12David McCloskey?

  I guess the other reason why these are going to keep happening, and I'm just, again, I'm comparing this to the Bangladesh Central Bank heist. If you remember, as the North Koreans were, were exfiltrating that money, there actually were people at various stages that had to be recruited by the North Koreans, physical people who worked at banks and who worked in logistics, who had to operate as kind of a network for the North Koreans. Most of them probably unwitting ultimately where it was going. But it was, you know, there, there was an actual, there was a legwork, operational legwork required to, to move that money out. In this case, it's very similar to the way that we now see like Russian intelligence operating in Europe, where you have these, you know, almost digital networks that in

• 33:57David McCloskey?

  many cases are easier to establish because you don't have people on the ground, right? You don't have that kind of investment that's required. So in this case, I mean, again, we're seeing 10 years on from Bangladesh, exfiltrating all this money doesn't even require humans outside of North Korea or, you know, wherever the, wherever the operational teams were when they, when they conducted the heist.

• 34:17Gordon Corera?

  Yeah, that's right. And I think on a, on a more serious note, I mean, it is worth reminding people that, you know, North Korea is supporting Russia's war in Ukraine. I mean, it's sending not just artillery shells, but also it's sent thousands of North Korean soldiers to fight the Ukrainians. So, you know, these kind of crypto heists are actually supporting that kind of activity, you know, not just the missile test. And I think there was actually a missile test just today on the Wednesday we're recording, which North Korea did in its region. But it's also, you know, carrying out pretty, pretty dark activity in, in Europe as well, supporting Russia. But the one interesting thing, when I was looking into this, was that the North Korean economy is actually doing pretty well. I mean, we think about it as this kind of hermit kingdom, which is, you know, struggling.

• 35:00Gordon Corera?

  But it grew last year by 3.5% its economy. And there was a Wall Street Journal piece from the summer saying, you know, restaurants there are serving up brick oven pizza and chicken wings and you can pay through a mobile QR code system. And there's, you know, Chinese electric vehicles on the street. So I think our image of North Korea maybe has to change a little bit based on partly its, its heists, but also the fact it's actually more integrated, I think, in getting more support from China maybe than it did in the past. So it's, you know, it's one to watch, I think.

• 35:30David McCloskey?

  This is not a, a state that's in the middle of a famine like it was in the mid 90s. I think so much of our mental pictures of it. This is a state that just conducted the largest heist in the history of the world. That is what we're, that's, that is what we just discussed is this state pulled that off. And, and you have to have a very sophisticated cyber capability and all of the human capital underneath that to pull it off.

• 35:53Gordon Corera?

  That's right. So just a reminder, keep your crypto wallet close to you and be careful about those job interviews.

• 36:00David McCloskey?

  Keep it close. Hold your, your loved ones and your crypto wallets.

• 36:04Gordon Corera?

  Hold them tight. Thanks for listening. Next episode of the CIA and Watergate. That fantastic series is out next week. Club members, of course, will get a deep dive into the crazy character at the center of that story, Howard Hunt, as well as getting a chance to hear none other than Anthony Scaramucci give us his views on Watergate. So do join if you're not already a member. It's the rest is classified.com.

• 36:29David McCloskey?

  Gordon, you've forgotten the newsletter. Listeners need to sign up for the newsletter. You can do that at the rest is classified.com/newsletter. And as a extra bonus for all of you people who sign up for the newsletter, I am writing a piece next week on the agency's publication review board process, which, as I say it out loud, doesn't sound as enticing as the piece almost certainly will be. So join the newsletter to get that.

• 36:58Gordon Corera?

  See you next time.

• 36:59David McCloskey?

  See you next time.

• 37:07Speaker 06

  At Farmers, we go out of our way to keep you in the know.

• 37:10Speaker 07

  Like by singing, everything for emphasis.

• 37:13Speaker 06

  That and by providing you with coverage on a page and easy to understand language. So you know what's covered and what's not.

• 37:19Speaker 07

  No confusing legalese that no one gets.

• 37:22Speaker 06

  In full transparency, we do have to put a disclaimer at the end of this ad, though. Just being honest, that's what you get when.

• 37:28Speaker 07

  You have farmers. Learn more at farmers.com. Underwritten by Farmers Truck or Fire Insurance Exchanges or Affiliates. Products not available in every state.

• 37:38Speaker 07

  Still wearing those old cargo shorts? If your wardrobe's due for an upgrade, but you don't know where to start, you need Stitch Fix. Your stylist learns your size, your style and your budget, then sends a box pick just for you. They always nail the fit. No store, no hassle, no subscription required. Get started today at stitchfix.com. That's stitchfix.com.

• 38:06Gordon Corera?

  Modafinil from mod.com is changing the way high performers get energy. Modafinil is a prescription treatment that engages multiple pathways in your brain to achieve steady energy and alertness for 10 to 12 hours. And it's now available at mod.com to qualifying patients. Visit mod.com for a free consultation and get 10% off your first order plus free shipping with promo code Spotify. That's promo code Spotify at mod.com.