North Korean Hacker Once Called “a Person Who Does Not Even Exist” Resurfaces Amid Binance’s $8 Billion Hack

North Korea-Linked Group Identified as Behind Binance Hack
Park Jin Hyok Back in Spotlight as Linked Group Is Mentioned
No Names in FBI Announcement... North Korea Denies Involvement

With North Korea identified as being behind the hack of Binance, the world’s largest cryptocurrency exchange, North Korean hacker Park Jin Hyok, who has been wanted by the United States for more than eight years, is once again drawing attention.

Park Jin Hyok, Wanted by U.S. for 8 Years, Resurfaces on Social Media

North Korean hacker Park Jinhyuk, wanted by the U.S. Federal Bureau of Investigation (FBI). Official website.

On November 7 (local time), The Wall Street Journal (WSJ), citing blockchain analytics firm Chainalysis, reported that “the hackers split the cryptocurrency stolen from Binance and moved it into more than 10,000 wallets.” Earlier, on October 31, the U.S. Federal Bureau of Investigation (FBI) identified the North Korea-linked hacking group TraderTraitor as responsible for the attack. Binance put the losses at about $6.3 billion (about KRW 8.56 trillion), equivalent to roughly one-fifth of North Korea’s gross national income (GNI).

According to Binance’s own investigation, the hackers planted malware in June by getting an employee who develops cryptocurrency wallets to download a tampered development tool. Three months later, they approached another engineer with a job offer and installed malware again under the pretext of an interview assignment. Blockchain analytics firm TRM Labs said, “The attackers siphoned funds from Binance wallets across 10 blockchains, with most of the funds drained in just 20 minutes.”

TraderTraitor is linked to Lazarus, a North Korean hacking group that Park Jin Hyok has been accused of being involved with. Park’s name and face were first made public on September 6, 2018. At the time, the U.S. Department of Justice released a criminal complaint stating that he had “participated in the 2014 Sony Pictures hack, the 2016 theft of funds from the Bangladesh central bank, and the 2017 WannaCry ransomware attack, among other incidents.” The Sony Pictures hack targeted the studio behind “The Interview,” a film about the assassination of North Korean leader Kim Jong Un. In February 2021, Park was also indicted on charges of conspiring to steal and extort more than $1.3 billion in cash and cryptocurrency (about KRW 1.77 trillion).

Park reportedly studied at Kim Chaek University of Technology in North Korea before working as a programmer for more than 10 years at Chosun Expo Joint Venture. He is also reported to have operated in Dalian, Liaoning Province, China. The United States described the company as “a front company supporting the cyber operations of Lab 110 under North Korea’s Reconnaissance General Bureau.” The FBI wanted poster lists two possible birth years, 1981 and 1984, and other names, including Pak Kwang Jin. His last known location is North Korea.

North Korea Once Claimed He “Did Not Exist”; FBI Announcement Is “Groundless Rumor”

Binance logo. Reuters-Yonhap News

However, the FBI announcement did not name Park or any other specific individuals. Cryptocurrency news outlet CCN noted that “evidence beyond his reputation or past affiliations would be needed to directly link Park Jin Hyok to the Binance hack.” After his face began circulating again on social media following the incident, some users commented, “What a waste of a face and talent.”

Meanwhile, in September 2018, a North Korean Foreign Ministry official denounced the U.S. indictment as a smear campaign against North Korea and claimed that Park Jin Hyok was “a person who does not even exist.” Regarding the latest incident, Kim Yo Jong, director of the General Affairs Department of the Workers’ Party of Korea, dismissed the FBI announcement as “an absurd and groundless rumor” in a statement on November 2. Referring to the U.S. administration’s policy of stockpiling seized cryptocurrency, Kim said, “If we consider who would receive the enormous amount of stolen cryptocurrency intact if it were recovered, that could provide a clue to who is behind this hacking incident.”

This content was produced with the assistance of AI translation services.