OCTOBER 31 — North Korea has long been associated with nuclear brinkmanship, ballistic missile development and international sanctions.
Yet another dimension of its national security apparatus has become increasingly consequential: cyber operations.
The reported US$6.3 billion cryptocurrency heist involving Binance, with North Korea emerging as a suspected culprit, illustrates the scale of the challenge.
What makes this development particularly significant is not merely the enormous sum allegedly stolen.
It is the possibility that cyber theft has become a recurring instrument of state financing and strategic competition.
North Korea’s alleged involvement in successive cryptocurrency attacks raises an uncomfortable question about the future of international security.
What happens when a sanctioned state can potentially generate billions of dollars through cyber operations without crossing a physical border?
The answer lies in understanding the emergence of what may be described analytically as the perpetual hacker state.
Unlike conventional military operations, cyberattacks can be conducted repeatedly, covertly and across jurisdictions.
They do not necessarily require large armies, sophisticated naval fleets or extensive logistical networks.
A relatively small number of highly trained operators, supported by technical infrastructure and intelligence capabilities, can potentially inflict disproportionate financial damage. This creates a strategic asymmetry.
Countries with substantially larger economies may invest billions in cybersecurity, yet remain vulnerable to attacks targeting employees, software suppliers, digital custodians and financial intermediaries.
North Korea’s suspected role in the US$1.5 billion Bybit cryptocurrency theft in February 2025 already demonstrated the magnitude of this threat.
The latest allegations concerning Binance reinforce the need to examine whether digital financial theft has become an enduring component of Pyongyang’s external operations.
There is a crucial distinction between ordinary cybercrime and state-linked cyber operations.
Criminal syndicates generally seek private enrichment.
State-directed operations may serve wider strategic objectives, including sanctions evasion, intelligence gathering and the acquisition of resources for national programmes.
For North Korea, which remains subject to extensive international restrictions, digital assets may offer opportunities unavailable through conventional financial channels.
Cryptocurrency provides rapid cross-border transferability.
Its decentralised architecture can complicate investigations, particularly when stolen assets are dispersed across multiple wallets and blockchains.
However, cryptocurrency transactions are not inherently invisible.
Blockchain analytics, coordinated enforcement and asset freezes have demonstrated that illicit flows can sometimes be traced and interrupted.
The central problem is therefore not that cryptocurrency is beyond regulation.
It is that cybercriminals and state-linked operators can exploit the gaps between national jurisdictions, corporate security systems and international enforcement mechanisms.
Artificial intelligence adds further complexity.
AI-assisted phishing, impersonation, reconnaissance and social engineering can increase the speed and sophistication of cyber operations.
Even the strongest cryptographic architecture cannot fully protect an exchange whose personnel or administrative systems have been compromised.
The blockchain may remain intact while the surrounding institution fails.
This is the fundamental chink in crypto’s armour.
The consequences extend well beyond cryptocurrency investors.
As digital assets become more closely connected to mainstream banking, payment systems and institutional investment, a major breach could produce wider financial instability.
For Asean, these developments warrant serious attention.
Malaysia, Singapore, Indonesia, Thailand and other regional economies are expanding their digital financial ecosystems.
They must ensure that innovation is accompanied by credible cybersecurity standards, effective supervision and stronger regional intelligence-sharing arrangements.
Asean should broaden and deepen cooperation with South Korea, Japan, China, the United States and European partners to identify illicit financial networks and improve cross-border asset recovery.
South Korea, in particular, possesses extensive experience in monitoring cyber threats attributed to its northern neighbour.
Its expertise can contribute to regional capacity-building without requiring Asean to become involved in the Korean Peninsula’s military confrontation.
Ultimately, North Korea’s alleged cryptocurrency activities illustrate a broader transformation in international security.
Economic warfare no longer requires physical blockades or the seizure of financial institutions.
It can increasingly be conducted through compromised networks, stolen credentials and manipulated digital infrastructure.
The perpetual hacker state is therefore not simply a description of North Korea’s suspected conduct.
It is a warning about a strategic model that other malicious actors could attempt to replicate.
As long as cyber operations offer substantial rewards at comparatively limited cost, the incentives for repeated attacks will persist.
The international community must respond by making such operations harder to execute, easier to detect and more costly to sustain.
The future of financial security will depend not only on protecting money, but also on protecting the digital systems through which money moves.
Without that protection, the perpetual hacker state may become one of the defining security challenges of the digital century.
* Phar Kim Beng is professor of Asean Studies, and director at the Institute of International and Asean Studies, International Islamic University Malaysia.
** This is the personal opinion of the writer or publication and does not necessarily represent the views of Malay Mail.
