The North Korean Said to Be the World’s Most Dangerous Hacker

1. Overview

The name of Park Jin Hyok, a North Korean first indicted by the U.S. Department of Justice in 2018 on cyberattack charges, began circulating again after a $6.3 billion hack hit Binance, the world’s largest cryptocurrency exchange. A post on an online community shared a screenshot of an FBI wanted poster and introduced him as “the world’s most dangerous hacker.” It suggested that he was suspected of masterminding the Sony Pictures hack, the theft from Bangladesh Bank, the WannaCry attack, and now the Binance theft.

However, U.S. authorities have officially charged him in connection with only the first three cases, and no evidence directly linking him to the Binance incident has been confirmed. Other sources also offer little support for claims accompanying the post about how the stolen funds were used or his language skills. The discussion therefore raises the question of where the charged allegations end and exaggeration begins.

2. U.S. Indictment and Allegations

Park Jin Hyok came to public attention in September 2018. The U.S. Department of Justice released a criminal complaint alleging that he had taken part in the 2014 Sony Pictures hack, the 2016 theft of $81 million from Bangladesh Bank, and the 2017 WannaCry ransomware attack. The complaint was filed in court on June 8 of that year, and an arrest warrant was issued at the time. The amount initially targeted at Bangladesh Bank was said to have been close to $1 billion. Sisa Journal noted that this was the first case in which the United States indicted a North Korean hacker over cyberattacks.

According to The Guardian, U.S. officials believed the attacks were retaliation for the Hollywood film The Interview, which satirized North Korea. WannaCry also caused major damage to the U.K.’s National Health Service (NHS). Computers at 48 NHS trusts were paralyzed, surgeries were canceled, and ambulances were diverted. At least 6,900 appointments were canceled, and as many as 19,000 were affected. A subsequent U.K. government report said the NHS had been vulnerable because basic security recommendations had not been followed.

The charges later expanded. An indictment filed in December 2020 was made public in February 2021, adding Jeon Chang-hyuk and Kim Il as defendants and broadening the scope of the alleged crimes. An arrest warrant for Park Jin Hyok was reissued on the same day. The FBI wanted poster lists conspiracy to commit wire fraud and bank fraud, as well as conspiracy to commit computer-related fraud (computer intrusion). It describes him as a state-sponsored programmer linked to a North Korean hacker group affiliated with the Reconnaissance General Bureau (RGB). It says he speaks English, Korean, and Chinese; previously traveled to and from China; and was last known to be in North Korea. Two different birth years, 1984 and 1981, are listed.

The 2018 criminal complaint also said that he graduated from Kim Chaek University of Technology and worked in Dalian, China, for Chosun Expo, a North Korean front company. The Guardian reported at the time that prosecutors believed he had operated from China but was now in North Korea. The BBC reported that the U.S. Treasury Department had sanctioned him and that he was alleged to be linked to Lab 110, one of the North Korean government’s hacking organizations, also known as the Lazarus Group.

3. North Korea’s Denial and Subsequent Sanctions

North Korea responded to the U.S. announcement by denying that Park Jin Hyok existed at all. In a September 2018 commentary carried by the Korean Central News Agency, North Korea’s Foreign Ministry called him “a person who does not exist” and claimed that the cybercrimes alleged by the United States had nothing to do with North Korea. It called sanctions against the Chosun Expo joint venture company a “farce.” North Korea also accused the United States of spreading falsehoods at a time when the two countries were supposed to be building trust under the joint statement issued at the U.S.–North Korea summit that June.

Nevertheless, the FBI continued to circulate a wanted poster featuring Park Jin Hyok’s photograph, and he remained publicly wanted as of the date of Sisa Journal’s report, November 2, 2026. A senior U.S. Justice Department official said in 2018 that the U.S. government had never discussed his extradition with the North Korean government. The United States has continued to indict North Korean hackers and publicize their identities. In 2024, it offered a reward of up to $10 million for information leading to the arrest of Rim Jong Hyok. Rim is alleged to belong to Andariel, a hacking group under the Reconnaissance General Bureau, and to have hacked defense contractors and NASA, among other targets. Professor Yoon Bong-han of Dongguk University told Sky Daily that it was unclear whether Rim would be arrested in the short term and that he was likely to operate covertly while concealing his identity.

International sanctions also continued. In November 2025, the Australian government designated four organizations and companies—Lazarus Group, Kimsuky, Andariel, and Chosun Expo—as well as Park Jin Hyok himself for financial sanctions, and barred him from entering or staying in Australia. The measures were coordinated with the United States and based on a report by the Multilateral Sanctions Monitoring Team (MSMT), which includes 11 countries, among them South Korea, the United States, and Japan. Australia’s Department of Foreign Affairs and Trade noted that North Korean cybercriminals stole at least A$1.9 billion worth of cryptocurrency in 2024 alone.

4. Binance Incident and Renewed Attention

According to Sisa Journal, on November 2, 2026, some foreign media and cryptocurrency outlets reported that the FBI had officially attributed the Binance hack to TraderTraitor, a North Korean hacking group, in coordination with the U.S. Secret Service (USSS) and the IRS Criminal Investigation Division (IRS-CI). These reports also mentioned Park Jin Hyok, and the French cryptocurrency outlet CoinTribune described him as a prominent figure the United States had targeted on cyber-conspiracy charges.

However, Park Jin Hyok’s name does not appear in the FBI’s announcement about the incident. CoinTribune likewise outlined his previous allegations and wanted status but presented no new evidence that he was directly involved in this case.

Blockchain analytics firm Chainalysis estimated that North Korean hackers stole at least $2.02 billion in cryptocurrency in 2025. Sisa Journal noted that the amount stolen in the Binance incident was about 3.1 times that estimate. Kim Heung-gwang, a computer science professor who defected from North Korea, told Al Jazeera in a 2011 interview that training hacking talent was much cheaper than buying new weapons or fighter jets. Sisa Journal interpreted this as a sign that “a second or third Park Jin Hyok” would continue to be trained.

5. Authenticity Debate

The central issue is whether the evidence supports calling Park Jin Hyok, an individual charged with hacking offenses, “the world’s most dangerous hacker” and tying him to the mastermind role in a recent incident.

5.1. The Case That He Is a Dangerous Hacker

Those who take this view point to the specific allegations the U.S. government has accumulated against one individual. In 2018, the U.S. Department of Justice filed a criminal complaint linking one person to the Sony, Bangladesh Bank, and WannaCry attacks. In December 2020, it obtained another arrest warrant and expanded the indictment. Treasury sanctions, an FBI wanted notice, and Australia’s independent sanctions followed, so the case is difficult to dismiss as mere speculation. Australia’s measures were based on a report by the Multilateral Sanctions Monitoring Team, which includes 11 countries, meaning the claims do not come from the United States alone.

Some also argue that the scale of the damage makes “the most dangerous” a reasonable description. WannaCry affected computers in more than 150 countries and brought hospital operations to a halt in the United Kingdom. In Bangladesh, $81 million was taken from the central bank. North Korean hackers are also estimated to have stolen at least $2.02 billion in cryptocurrency in 2025 alone, which, they argue, shows that the threat is real. The claim that he is unlikely to be arrested is not without basis either: the United States said it had never discussed his extradition with North Korea, and it would be difficult to obtain custody of him if North Korea continues to deny that he exists.

5.2. The Case That the Claims Are Exaggerated

The opposing view first objects to the conflation of “allegations” with “established facts.” Park Jin Hyok has been indicted and is wanted, but the FBI poster describes the claims against him as allegations. His name came up in connection with the Binance incident not in the FBI’s announcement, but in reports by foreign media and cryptocurrency outlets. As Sisa Journal noted, even CoinTribune offered no new evidence, so describing him as a “suspected mastermind,” as the post does, is an unsupported interpretation. The post put the amount stolen at “more than 1 trillion yen,” while Sisa Journal reported $6.3 billion (about 8.4 trillion won), so even the figures do not match.

Several other claims added by the post cannot be confirmed through other sources. The claim that the U.S. government had “confirmed” the stolen funds were being used for nuclear weapons, strategic missiles, AI-equipped drones, and destroyers capable of launching nuclear cruise missiles does not appear in other reports. The post says he is fluent in Bengali as well, but the languages listed on the FBI poster are only English, Korean, and Chinese. The Bengali claim appears to be unsubstantiated hearsay, with no clear source. The poster, in fact, alleges that he was part of a broad criminal conspiracy carried out by a hacker group affiliated with the Reconnaissance General Bureau. Critics also argue that portraying one person as the world’s worst hacker obscures the organized nature of these operations. Separate from North Korea’s claim that he is “a person who does not exist,” questions remain because the United States has said only that his last known location was North Korea, without specifying where he is now.

The two sides’ positions are not entirely at odds. Both acknowledge that he is a hacking suspect indicted in the United States and has been wanted for eight years. His direct connection to the Binance incident and the description “the world’s most dangerous” remain insufficiently supported.

6. Trivia

• The suspicion that North Korea hacked Sony Pictures arose in connection with The Interview, a film that included a scene showing the North Korean leader naked, the BBC reported. North Korean state media warned of “merciless retaliation” at the time, The Guardian reported.
• The headline of The Guardian article put the word “hacker” in single quotation marks when referring to Park Jin Hyok.
• The image in the post is a screenshot of the FBI wanted poster. The poster lists several aliases alongside the name Park Jin Hyok, including Jin Hyok Park, Pak Jin Hyok, and Pak Kwang Jin.