The Sony hack proved that North Korea could destroy things. Next, they proved that they could steal.
Not just from one bank and not just once, but systematically, at scale, from the global financial system itself.
Episode 5 of To Catch a Thief traces that evolution from a misspelled bank transfer to the largest theft in human history, with an estimated $5 to $6 billion in cryptocurrency stolen along the way.
After Sony, Follow the Money
The shift in North Korea’s cyber strategy after the Sony hack was deliberate. The same tradecraft used to wipe Sony’s systems (phishing, lateral movement, patient network mapping) could be turned toward a different target entirely—banks.
The lesson was simple: destructive cyber attacks make headlines, financial cyber attacks make money.
The Bangladesh Blueprint
Starting in January 2015, North Korean hackers were inside Bangladesh Bank, silently mapping its network. They spent nearly a year hunting for one thing: the bank’s connection to SWIFT, the global communications protocol that banks use to transfer funds between each other.
“SWIFT is really a communications protocol, like a chat messaging system,” Chien explained. “If I’m logged into my SWIFT account and I send you a message and say, ‘Please debit two million,’ you trust that what I am doing is accurate.”
Once inside that terminal, he said: “You’re in the vault. You have everything.”
The attack they executed on February 4th, 2016 required Ocean’s Eleven-level coordination. The date was chosen meticulously: Thursday evening in Bangladesh, the start of their Friday-Saturday weekend, while the New York Fed was still operating. Transfer destinations reflected the DPRK’s preferred laundering machine—banks and casinos in Sri Lanka and the Philippines—were chosen for lax regulations. The hackers sent 36 orders to the New York Fed totaling $951 million, nearly the entire contents of Bangladesh Bank’s account.
Two things stopped them from walking away with close to a billion dollars. First, a typo: “Shalika Fandation” instead of “Foundation.” Then, bad luck: one receiving bank was located on Jupiter Street in Manila, a name that matched a sanctioned Iranian shipping company in the US Treasury’s database. The Fed flagged the transactions. North Korea still got away with $81 million.
It was still the largest cyber heist of its time—and it was only proof of concept.
Entering the Crypto Era
Bangladesh exposed the limits of robbing the traditional banking system: too many choke points.
But cryptocurrency arrived as a solution at precisely the right moment.
“It’s almost like an intervention by God that this opportunity arises to pivot from traditional banks into crypto,” said Nick Carlsen, who tracked North Korea at the FBI.
Crypto had no central authority. Transfers were irreversible and the blockchain’s public ledger meant anyone could see exactly where large pools of money were sitting. “It’s quite obvious how much is sitting in exchanges,” said Heidi Wilder, a security researcher at Coinbase. “So you know, at minimum, I could make this amount of money.”
North Korea moved fast. After a brief detour through WannaCry—a May 2017 ransomware attack that struck 150 countries, paralyzed 40 UK hospitals, and was stopped only when a researcher named Marcus Hutchins registered an unregistered kill-switch domain embedded in the code—the DPRK settled into a systematic campaign against crypto.
The playbook escalated in stages. First, they phished individual wallet holders for private keys. Then, they targeted centralized exchanges through fake job offers using a campaign now known as the “Contagious Interview.” Posing as a recruiter, the DPRK ran fake interview rounds, sent a malware-laced PDF offer letter, gained access to an employee’s machine, moved laterally until they had enough signing keys to drain the vault. Then they targeted the bridges between blockchains—the infrastructure that lets users move digital assets from one ecosystem to another, often less secured than the blockchains themselves.
Through it all, the industry kept underestimating them. “There’s sort of a tendency in cybersecurity to conflate like, is this technique new and fancy? Is the threat actor who’s using this technique capable?” said Matt Muller, former head of security operations at Coinbase. “These low-level and relatively unsophisticated techniques, when applied by a threat actor that has no incentive to stop trying them, they’re just going to be successful over time and at scale.”
The Ronin Bridge to Bybit
In March 2022, North Korea attacked the Ronin Bridge, infrastructure connecting a blockchain built for the game Axie Infinity to the broader Ethereum ecosystem. The attack came through one engineer: a fake LinkedIn recruiter, fake interview rounds, a malware-laced PDF job offer. One compromised developer gave them access to four of the five required validator keys. A paperwork failure—a fifth validator had loaned its key to the game company for faster approvals and never reclaimed it—gave them the rest. North Korea walked away with more than $600 million. Nobody noticed for six days.
“It wasn’t technical brilliance,” said Rob Joyce, who ran the Cybersecurity Directorate and all the hacking divisions at NSA. “It was social engineering mastery.”
And then came Bybit.
On February 21st, 2025, $1.5 billion in Ether vanished from one of the world’s largest cryptocurrency exchanges. The largest theft in human history—surpassing even Saddam Hussein’s 2003 raid on the Iraqi Central Bank.
North Korea didn’t hack Bybit directly. They compromised the interface Bybit’s authorized signers used to review and approve transactions, tweaking it so that what appeared to be a routine transfer was, beneath the surface, an instruction handing the hackers control of the funds. The CEO of Bybit personally authorized what he believed was a standard cold wallet transfer.
But he was actually handing North Korea the keys to the system.
“They hacked the user experience of the people working inside this space,” said Rob Joyce, who ran the Cybersecurity Directorate and all the hacking divisions at NSA.
It was a world record heist—and the world barely blinked.
Listen: To Catch a Thief
North Korea is estimated to have stolen between $5 and $6 billion in cryptocurrency. Nick Carlsen puts their share of global crypto theft at 70 to 80 percent annually. “They’re the Google of crypto theft,” he said. “They completely control this.”
Now, as the United States moves to position itself as the “crypto capital of the planet” and financial institutions adopt the technology, the security community has a new concern.. “It’s not that they’re beating us in the race,” said Michael Barnhart of DTEX. “They made the race. You’re going to have the most skilled actor in that space waiting for you.”
Episode 5 of To Catch a Thief is out now. To Catch a Thief is co-produced by Nicole Perlroth and Rubrik, in partnership with Pod People. Follow the show wherever you listen to podcasts.