On 29 October 2026, approximately $6.36 billion in cryptoassets was moved out of Binance’s hot wallets across ten blockchains, most of it within roughly twenty minutes. Blockchain intelligence firms TRM Labs and Chainalysis attributed the operation with “high confidence” to TraderTraitor, a unit associated with the Lazarus Group and widely identified as a DPRK state-linked cyber formation. Binance froze some $3 billion and pledged to cover all losses, while the price of bitcoin fell more than 3 per cent as markets absorbed the implications.

The immediate facts are stark enough. This was the largest single theft of cryptoassets on record, more than four times the $1.5 billion taken from Bybit in 2025 and, by Elliptic’s reckoning, almost certainly the largest known theft of any kind in history. The technical vector was unremarkable in its banality: a compromised engineer’s laptop, not a broken cryptographic vault, gave the attackers a path into a system authorised to sign withdrawals. The architecture of centralised crypto exchanges, which concentrate enormous pools of value under a single operational chokepoint, did the rest.

But the significance of the Binance seizure does not lie in its novelty or its scale alone. It lies in what it reveals about the conditions under which the DPRK is compelled to operate, and about the nature of the terrain on which this struggle is taking place.

The Democratic People’s Republic of Korea exists under one of the most comprehensive sanctions regimes ever assembled. Its access to hard currency, correspondent banking, commodity markets and conventional trade finance has been systematically severed by the imperialist powers. Unlike Russia, which retains an economy, energy exports and trade partners willing to circumvent restrictions, or Iran, which still possesses sanctioned oil and proxy financial networks, the DPRK has been pushed into a position where the theft of digital assets is not a speculative venture but a structural necessity for regime survival. The U.S. Treasury and multiple intelligence agencies have themselves confirmed that crypto theft is a primary funding mechanism for the country’s weapons programmes.

To describe this as “cybercrime” in the abstract, as Western analysts invariably do, is to obscure the political economy of the situation. Sanctions are not a neutral instrument of international governance; they are a form of economic warfare waged by the stronger imperialist powers against a weaker adversary, designed to strangulate an entire population and its productive capacities. When a state subjected to such a siege seizes assets from a financial institution that operates at the very heart of global speculative capital, it is engaging in an act of expropriation under conditions of extreme asymmetry. The moral vocabulary of “theft” and “criminality” is applied selectively: the same governments that denounce the DPRK’s seizures preside over financial systems built on the expropriation of labour, the extraction of monopoly rents and the periodic destruction of entire economies through debt and structural adjustment.

Binance itself is no innocent victim. It is the world’s largest crypto exchange, with 335 million registered users and $162.8 billion in assets under custody as of its 2025 annual report. Its founder, Changpeng Zhao, pleaded guilty in 2023 to a felony related to failing to prevent money laundering and was subsequently pardoned by the U.S. president in 2025. The institution is a central node in the circulation of speculative finance capital, a sphere in which value appears to multiply without passing through the production of use-values, and in which the line between legitimate accumulation and predatory seizure is drawn not by principle but by power. That the DPRK should target such an institution is not an accident. It is a recognition that in the current phase of imperialist rivalry, the circuits of finance are themselves a battleground.

The Lazarus Group’s operations have grown in sophistication and ambition. Elliptic estimates that DPRK-linked actors had already stolen over $6.5 billion in cryptoassets in recent years before this incident, and that the Binance haul alone would almost double that total. The attackers are not marginal figures operating in isolation; they are part of a state-directed apparatus that has institutionalised cyber capabilities as a means of generating foreign currency and undermining the financial controls imposed by the imperialist bloc. The DPRK has consistently denied responsibility, and no formal claim has been made, but the pattern of attribution by private intelligence firms—firms embedded in the very financial architecture they analyse—serves a dual function: it identifies an adversary and it legitimates the further securitisation of the crypto sphere.

What the Binance episode ultimately demonstrates is that the struggle over cryptoassets is not a technical contest between hackers and exchanges. It is a political struggle over the control of value in a world divided between those who set the rules of the financial system and those who are excluded from it. The DPRK’s seizures are a brutal, desperate and unmistakably political response to a brutal, systematic and equally political siege. To understand them otherwise—as mere criminality, or as the work of an irrational regime—is to refuse to see the structures that produce such actions. The billions moved out of Binance’s wallets in twenty minutes are not simply a security failure. They are a symptom of a world order in which the expropriators have themselves become expropriable, and in which the most vulnerable participants in that order have learned to turn its own instruments against it.