← News Topics
Intermediate

The Binance Heist: Money, Technology, and Power

Day 3 — Why Has North Korea Turned to Cryptocurrency Theft?

バイナンス強盗事件：お金、技術、そして権力 ― 第3日：なぜ北朝鮮は暗号資産窃盗に向かったのか

3 November 2026

Sealed briefing folders and a laptop showing an abstract blockchain wallet trail with alert markers on a desk, suggesting sanctions and cryptocurrency theft investigations

In March 2024, an employee at Ginco, a Japanese company that develops cryptocurrency wallet software, received a message from someone posing as a recruiter. The supposed recruiter offered a programming test, but the code was malicious. Weeks later, hackers used information obtained through the attack to manipulate a transaction involving DMM Bitcoin, a Japanese cryptocurrency exchange, stealing approximately $308 million. Japanese and American investigators later traced the theft back to TraderTraitor, a hacking group linked to North Korea.

2024年3月、暗号資産ウォレットソフトを開発する日本企業Gincoの従業員が、採用担当者を装った人物からメッセージを受け取りました。その自称採用担当者はプログラミング試験を提案しましたが、コードは悪意のあるものでした。数週間後、ハッカーはその攻撃で得た情報を使い、日本の暗号資産取引所DMM Bitcoinが関わる取引を操作し、およそ3億800万ドルを盗みました。日米の捜査関係者は、のちにその窃盗を、北朝鮮と結びつけられるハッキング集団トレーダートレイターまでたどりました。

The same group’s name appeared again after the $6.3 billion Binance theft in October 2026. On October 31, the FBI identified TraderTraitor as responsible. Why would a government be involved in stealing cryptocurrency from private companies overseas? The answer lies partly in North Korea’s difficult relationship with the international financial system. What looks like an ordinary financial crime may also be part of a much larger effort to obtain money for the state.

同じ集団の名前は、2026年10月の63億ドルのバイナンス窃盗の後にも再び現れました。10月31日、FBIはトレーダートレイターが責任を負うと特定しました。なぜ政府が、海外の民間企業から暗号資産を盗むことに関わるのでしょうか。答えの一部は、国際金融システムとの北朝鮮の困難な関係にあります。普通の金融犯罪のように見えるものが、国家のために資金を得る、はるかに大きな取り組みの一部でもあるのかもしれません。

North Korea has faced international sanctions for years because of its nuclear weapons and ballistic missile programs. In 2017, the United Nations banned countries from buying major North Korean exports, including coal, seafood, and textiles. Restrictions also limited the country’s access to international banking services. These measures were designed to cut off sources of foreign income that could support weapons development. But North Korea still needs hard currency, such as US dollars, to purchase goods and services abroad. Its own currency, the won, has little use in international trade.

北朝鮮は、核兵器と弾道ミサイル計画のために、何年も国際制裁に直面してきました。2017年、国連は各国に対し、石炭、海産物、繊維製品を含む主要な北朝鮮の輸出品の購入を禁じました。制限はまた、同国の国際銀行サービスへのアクセスも狭めました。これらの措置は、兵器開発を支えうる外貨収入の源を断つために設計されました。しかし北朝鮮は、海外で財やサービスを買うために、米ドルなどのハードカレンシーを今も必要としています。自国通貨のウォンは、国際貿易ではほとんど使えません。

North Korea is not the only sanctioned country with sophisticated hackers. Iran also has powerful cyber groups, some of which have engaged in cryptocurrency theft. Yet Iran uses digital currencies in another important way: to get around financial restrictions and move funds connected to activities such as oil trading. Despite sanctions, Iran still earns substantial revenue from oil exports. North Korea, by contrast, has far fewer opportunities to earn foreign currency through conventional trade. The difference is not simply technological ability, but also how the two countries obtain foreign income.

北朝鮮は、高度なハッカーを抱える制裁下の国として唯一ではありません。イランにも強力なサイバー集団があり、その一部は暗号資産窃盗にも関わってきました。しかしイランは、デジタル通貨を別の重要な方法でも使います。金融上の制限をすり抜け、石油取引などの活動に結びつく資金を動かすことです。制裁にもかかわらず、イランは今も石油輸出から相当な収入を得ています。対照的に、北朝鮮は従来の貿易で外貨を稼ぐ機会がはるかに少ないです。違いは単なる技術力ではなく、両国が外貨収入をどう得るかにもあります。

What makes North Korea particularly striking is the scale of its cryptocurrency theft. According to blockchain analysis firm TRM Labs, North Korean hackers were responsible for an estimated 63% of the value of cryptocurrency stolen worldwide in 2025. Unlike ordinary criminal groups seeking personal profit, these state-sponsored operations are believed to generate revenue for the government. North Korea has used overseas brokers and front companies—businesses that conceal who is really behind financial transactions—to convert stolen assets and arrange payments on behalf of North Korean organizations. The US Treasury says such networks help finance the country’s weapons programs. However, the amount stolen is not necessarily the amount the government can ultimately use.

北朝鮮をとりわけ際立たせているのは、暗号資産窃盗の規模です。ブロックチェーン分析会社TRM Labsによると、2025年に世界で盗まれた暗号資産の価値のうち、推定63%を北朝鮮のハッカーが担っていました。個人的な利益を求める普通の犯罪集団と違い、これらの国家支援の作戦は、政府の収入を生むと考えられています。北朝鮮は、盗んだ資産を換金し、北朝鮮の組織に代わって支払いを手配するために、海外のブローカーとフロント企業―金融取引の本当の背後に誰がいるかを隠す事業―を使ってきました。米国財務省は、そのようなネットワークが同国の兵器計画の資金調達を助けると述べています。しかし、盗まれた額は、政府が最終的に使える額とは必ずしも一致しません。

Japan has already experienced the consequences. Following the DMM Bitcoin theft, Japan, the United States, and South Korea issued a joint warning in January 2025 about North Korean cryptocurrency attacks. Their concern goes beyond protecting individual companies from financial losses. When stolen assets can be turned into usable government revenue, cryptocurrency theft becomes a way to weaken the effect of international sanctions. Governments can restrict North Korea’s access to foreign markets and banks, but those restrictions alone cannot prevent hackers from stealing assets from companies abroad. The challenge is therefore not only to stop the thefts, but also to prevent stolen cryptocurrency from becoming a source of funding for a state’s military ambitions.

日本はすでにその結果を経験しています。DMM Bitcoin窃盗の後、日本、アメリカ、韓国は2025年1月、北朝鮮による暗号資産攻撃について共同警告を出しました。彼らの懸念は、個々の企業を金銭的損失から守ることだけにとどまりません。盗まれた資産が使える政府収入に変わりうるとき、暗号資産窃盗は国際制裁の効果を弱める手段になります。政府は北朝鮮の海外市場や銀行へのアクセスを制限できますが、そうした制限だけでは、ハッカーが海外の企業から資産を盗むのを防げません。したがって課題は、窃盗を止めるだけでなく、盗まれた暗号資産が国家の軍事的野心の資金源になるのを防ぐことでもあります。

Vocabulary

  1. pose as — To pretend to be someone else, especially in order to deceive people. Example: The criminal posed as a bank employee and persuaded customers to reveal their account information.
  2. trace something back to — To discover the origin or cause of something by investigating its history or connections. Example: Investigators traced the suspicious payments back to a company operating overseas.
  3. sanction — An official restriction imposed on a country, organization, or person to influence their behavior. Example: The government imposed economic sanctions to pressure the country to abandon its weapons program.
  4. cut off — To stop or interrupt the supply of something, such as money, information, or resources. Example: International banks cut off access to financial services for companies involved in illegal transactions.
  5. hard currency — Money from a country with a relatively stable and widely accepted currency, especially one that can be used in international trade. Example: The country needed hard currency to purchase medical equipment from foreign suppliers.
  6. get around — To find a way to avoid or overcome a rule, restriction, or difficulty. Example: Some companies tried to get around the trade restrictions by using intermediaries in other countries.
  7. state-sponsored — Supported, financed, or directed by a government. Example: Security experts warned that the attacks might be part of a state-sponsored cyber operation.
  8. front company — A business used to hide the identity of the people or organizations actually controlling an activity. Example: Investigators discovered that the payments had passed through a front company established to conceal the real buyer.
  9. on behalf of — As a representative of, or for the benefit of, another person or organization. Example: The agent negotiated the contract on behalf of several overseas investors.

Comprehension Questions

  1. How did the hackers begin the attack that eventually affected DMM Bitcoin?
    1. They directly attacked the Japanese government’s computer systems.
    2. They contacted a Ginco employee while pretending to be a recruiter and offered a malicious programming test.
    3. They persuaded DMM Bitcoin customers to transfer their cryptocurrency voluntarily.
    4. They exploited a sudden fall in Bitcoin prices to obtain access to DMM Bitcoin’s accounts.

    最終的にDMM Bitcoinに影響した攻撃を、ハッカーはどのように始めましたか？

  2. Why has North Korea faced international economic sanctions?
    1. Because it has refused to use cryptocurrency in international trade.
    2. Because it has stopped exporting goods to neighboring countries.
    3. Because of its nuclear weapons and ballistic missile programs.
    4. Because its national currency is not widely accepted overseas.

    北朝鮮が国際経済制裁に直面してきたのはなぜですか？

  3. What difference between Iran and North Korea does the article emphasize?
    1. Iran has no sophisticated cyber capabilities, while North Korea does.
    2. Iran uses cryptocurrency only for domestic purchases, while North Korea uses it internationally.
    3. North Korea can earn substantial foreign income from oil exports, while Iran cannot.
    4. Iran can use cryptocurrency to move funds connected to existing trade, while North Korea has fewer conventional opportunities to earn foreign currency.

    記事が強調する、イランと北朝鮮の違いは何ですか？

  4. According to TRM Labs, approximately what share of the value of cryptocurrency stolen worldwide in 2025 was attributed to North Korean hackers?
    1. 13%
    2. 39%
    3. 63%
    4. 85%

    TRM Labsによると、2025年に世界で盗まれた暗号資産の価値のうち、およそどの割合が北朝鮮のハッカーによるものとされましたか？

  5. Why did Japan, the United States, and South Korea issue a joint warning about North Korean cryptocurrency attacks?
    1. They were concerned that cryptocurrency theft could provide funds for North Korea’s government and weapons programs.
    2. They wanted to prohibit all international cryptocurrency transactions.
    3. They had confirmed that all stolen cryptocurrency had already been recovered.
    4. They wanted to replace conventional international banking with cryptocurrency payments.

    日本、アメリカ、韓国が北朝鮮の暗号資産攻撃について共同警告を出したのはなぜですか？

Discussion Questions

  1. North Korea has limited opportunities to earn foreign currency through conventional trade, while Iran can still obtain revenue from oil exports. How might differences in a country’s economic resources influence the methods it uses to respond to international sanctions?

    北朝鮮は従来の貿易で外貨を稼ぐ機会が限られている一方、イランは石油輸出からなお収入を得られます。国の経済資源の違いは、国際制裁への対応方法にどのように影響しうるでしょうか？

  2. According to TRM Labs, North Korean hackers accounted for an estimated 63% of the value of cryptocurrency stolen worldwide in 2025. What does this figure tell us about the scale of the problem, and what additional information would help us understand North Korea’s role more accurately?

    TRM Labsによると、北朝鮮のハッカーは2025年に世界で盗まれた暗号資産の価値の推定63%を占めました。この数字は問題の規模について何を伝え、北朝鮮の役割をより正確に理解するためにどのような追加情報が役立つでしょうか？

  3. Governments use economic sanctions to restrict funding for activities such as weapons development. How can sanctions remain effective when a targeted country obtains money through cybercrime? What additional measures might be needed?

    政府は、兵器開発などの活動への資金を制限するために経済制裁を使います。対象国がサイバー犯罪で資金を得るとき、制裁はどのように効果を保ちうるでしょうか。どのような追加措置が必要になりうるでしょうか？

  4. North Korea has used overseas brokers and front companies to move money and arrange payments. What makes it difficult for governments and financial institutions to identify these networks without interfering unnecessarily with legitimate international business?

    北朝鮮は、資金を動かし支払いを手配するために海外のブローカーとフロント企業を使ってきました。正当な国際ビジネスに不必要に干渉せずに、政府や金融機関がこれらのネットワークを特定することが難しいのはなぜでしょうか？

  5. Japan, the United States, and South Korea have cooperated to address North Korean cryptocurrency theft. What roles should governments, cryptocurrency exchanges, and private cybersecurity companies play in preventing state-sponsored cybercrime? How should responsibilities be divided?

    日本、アメリカ、韓国は、北朝鮮の暗号資産窃盗に対処するために協力してきました。国家支援のサイバー犯罪を防ぐうえで、政府、暗号資産取引所、民間サイバーセキュリティ企業はどのような役割を果たすべきでしょうか。責任はどのように分けるべきでしょうか？

Speaking Practice

One-Minute News Briefing

Imagine that a colleague asks you why North Korea is frequently mentioned in reports about major cryptocurrency thefts. Give a short explanation of approximately one minute, covering the following points: Why North Korea faces international economic sanctions and needs foreign currency. How its use of cryptocurrency differs from that of another sanctioned country, such as Iran. Why North Korea’s cryptocurrency thefts are considered more than ordinary financial crimes. Why the problem matters to Japan and the international community. Try to use at least three expressions from today’s Vocabulary.

1分ニュース・ブリーフィング。同僚が、なぜ北朝鮮が大規模な暗号資産窃盗の報道で頻繁に出てくるのかと尋ねてきたつもりで話してください。およそ1分で、次の点をカバーしてください。北朝鮮が国際経済制裁に直面し、外貨を必要とするのはなぜか。イランなど別の制裁下の国と比べて、暗号資産の使い方がどう違うか。北朝鮮の暗号資産窃盗が普通の金融犯罪以上とみなされるのはなぜか。この問題が日本と国際社会にとって重要なのはなぜか。今日のVocabularyから少なくとも三つの表現を使ってください。