Key Takeaways
- Park Jin Hyok is wanted by the FBI over alleged involvement in North Korean state-sponsored cyberattacks.
- US prosecutors linked his alleged conspiracy to Sony, WannaCry, and the Bangladesh Bank theft, later expanding the case to cryptocurrency crimes.
- The FBI attributed Binance’s $6.3 billion theft to North Korea’s TraderTraitor activity, without publicly naming Park as a participant.
Park Jin Hyok, the North Korean programmer wanted by the FBI over alleged involvement in some of the world’s most damaging cyberattacks, is drawing renewed attention following Binance’s approximately $6.3 billion cryptocurrency theft.
A post by X user Nana Sei Anyemedu recirculated Park’s background as scrutiny of Pyongyang’s hacking operations returned.
The FBI has attributed the Binance attack to North Korean activity it tracks as TraderTraitor.
However, its public alert does not identify Park as a participant in the breach. His documented history provides context, rather than proof of involvement.
Who Is Park Jin Hyok?
The FBI describes Park as an alleged state-sponsored computer programmer associated with a hacking conspiracy operating under North Korea’s Reconnaissance General Bureau, its military intelligence agency.
Researchers have used names such as Lazarus Group and APT38 for groups within the alleged conspiracy.
Park’s aliases include Jin Hyok Park, Pak Jin Hek and Pak Kwang Jin. His FBI wanted notice lists reported birth years of 1981 and 1984, illustrating the uncertainty surrounding even basic details of his identity.
The agency says he previously traveled to China and was last known to be in North Korea.
According to a Justice Department complaint unsealed in September 2018, Park worked for more than a decade at Chosun Expo Joint Venture.
Prosecutors described the business, which maintained offices in China and North Korea, as a government front affiliated with military intelligence.
They alleged that legitimate programming work for international customers operated alongside malicious cyber activities.
Sony, WannaCry, and Bank Theft Define the Allegations
US prosecutors linked Park’s alleged conspiracy to three landmark incidents: the 2014 Sony Pictures attack, the 2016 theft of $81 million from Bangladesh Bank and the 2017 WannaCry ransomware outbreak.
The Sony operation involved stolen confidential information, threats against employees, and damage to thousands of computers. Prosecutors described it as retaliation for “The Interview,” a comedy depicting the assassination of North Korea’s leader.
WannaCry subsequently disrupted computers worldwide, including systems within Britain’s National Health Service. The Justice Department connected its development to the conspiracy through shared malware characteristics and infrastructure.
Investigators said they traced overlapping email accounts, phishing activity, malware code, and internet infrastructure to establish connections between the attacks.
In February 2021, prosecutors expanded the case, naming Park alongside Jon Chang Hyok and Kim Il in an alleged conspiracy to steal and extort more than $1.3 billion in money and cryptocurrency.
The indictment also described malicious cryptocurrency applications that opened backdoors into victims’ computers, as well as attacks targeting cryptocurrency businesses. Those allegations placed digital asset theft within the group’s broader financial operations years before the Binance incident.
The charges remain accusations; the defendants are presumed innocent unless proven guilty.
Binance Attribution Stops Short of Naming Park
The latest incident has intensified attention on North Korea’s capacity to compromise major cryptocurrency platforms.
Binance said unauthorized withdrawals from its hot wallets on Oct. 29 caused approximately $6.3 billion in losses. Its update said that investigators initially identified a potentially compromised laptop but later uncovered additional points of entry.
The exchange reported no evidence that wallet private keys had leaked and pledged to absorb the financial impact through its insurance fund and corporate treasury.
On Oct. 31, the FBI attributed the theft to North Korea’s TraderTraitor activity. It said investigators observed attackers converting stolen assets primarily into ether and urged cryptocurrency service providers to block transactions involving identified addresses.
That attribution identifies a state-linked operation, without publicly establishing which individuals executed it.
Park’s outstanding charges explain his prominence in discussions of North Korean hacking, but linking him personally to Binance requires evidence beyond his reputation and alleged historical affiliations.
Top Trending Crypto Articles
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Giuseppe Ciccomascolo began his career as an investigative journalist in Italy, where he contributed to both local and national newspapers, focusing on various financial sectors.
Upon relocating to London, he worked as an analyst for Fitch's CapitalStructure and later as a Senior Reporter for Alliance News. In 2017, Giuseppe transitioned to covering cryptocurrency-related news, producing documentaries and articles on Bitcoin and other emerging digital currencies. He also played a pivotal role in establishing the academy for a cryptocurrency exchange website. Crypto remained his primary area of interest throughout his tenure as a writer for ThirdFloor.
