# The North Korean Said to Be the World’s Most Dangerous Hacker

> URL: https://www.cityhorror.wiki/en/%EC%84%B8%EA%B3%84%EC%97%90%EC%84%9C-%EA%B0%80%EC%9E%A5-%EC%9C%84%ED%97%98%ED%95%9C-%ED%95%B4%EC%BB%A4%EB%9D%BC%EB%8A%94-%EB%B6%81%ED%95%9C%EC%9D%B8
> Estimated date: 2014 ~ 2018
> Last updated: 2026-11-03
> Korean original: https://www.cityhorror.wiki/%EC%84%B8%EA%B3%84%EC%97%90%EC%84%9C-%EA%B0%80%EC%9E%A5-%EC%9C%84%ED%97%98%ED%95%9C-%ED%95%B4%EC%BB%A4%EB%9D%BC%EB%8A%94-%EB%B6%81%ED%95%9C%EC%9D%B8

## Overview

The name of Park Jin Hyok, a North Korean first indicted by the U.S. Department of Justice in 2018 on cyberattack charges, began circulating again after a $6.3 billion hack hit Binance, the world’s largest cryptocurrency exchange. A post on an online community shared a screenshot of an FBI wanted poster and introduced him as “the world’s most dangerous hacker.” It suggested that he was suspected of masterminding the Sony Pictures hack, the theft from Bangladesh Bank, the WannaCry attack, and now the Binance theft.

However, U.S. authorities have officially charged him in connection with only the first three cases, and no evidence directly linking him to the Binance incident has been confirmed. Other sources also offer little support for claims accompanying the post about how the stolen funds were used or his language skills. The discussion therefore raises the question of where the charged allegations end and exaggeration begins.

## U.S. Indictment and Allegations

Park Jin Hyok came to public attention in September 2018. The U.S. Department of Justice released a criminal complaint alleging that he had taken part in the 2014 Sony Pictures hack, the 2016 theft of $81 million from Bangladesh Bank, and the 2017 WannaCry ransomware attack. The complaint was filed in court on June 8 of that year, and an arrest warrant was issued at the time. The amount initially targeted at Bangladesh Bank was said to have been close to $1 billion. Sisa Journal noted that this was the first case in which the United States indicted a North Korean hacker over cyberattacks.

According to The Guardian, U.S. officials believed the attacks were retaliation for the Hollywood film *The Interview*, which satirized North Korea. WannaCry also caused major damage to the U.K.’s National Health Service (NHS). Computers at 48 NHS trusts were paralyzed, surgeries were canceled, and ambulances were diverted. At least 6,900 appointments were canceled, and as many as 19,000 were affected. A subsequent U.K. government report said the NHS had been vulnerable because basic security recommendations had not been followed.

The charges later expanded. An indictment filed in December 2020 was made public in February 2021, adding Jeon Chang-hyuk and Kim Il as defendants and broadening the scope of the alleged crimes. An arrest warrant for Park Jin Hyok was reissued on the same day. The FBI wanted poster lists conspiracy to commit wire fraud and bank fraud, as well as conspiracy to commit computer-related fraud (computer intrusion). It describes him as a state-sponsored programmer linked to a North Korean hacker group affiliated with the Reconnaissance General Bureau (RGB). It says he speaks English, Korean, and Chinese; previously traveled to and from China; and was last known to be in North Korea. Two different birth years, 1984 and 1981, are listed.

The 2018 criminal complaint also said that he graduated from Kim Chaek University of Technology and worked in Dalian, China, for Chosun Expo, a North Korean front company. The Guardian reported at the time that prosecutors believed he had operated from China but was now in North Korea. The BBC reported that the U.S. Treasury Department had sanctioned him and that he was alleged to be linked to Lab 110, one of the North Korean government’s hacking organizations, also known as the Lazarus Group.

## North Korea’s Denial and Subsequent Sanctions

North Korea responded to the U.S. announcement by denying that Park Jin Hyok existed at all. In a September 2018 commentary carried by the Korean Central News Agency, North Korea’s Foreign Ministry called him “a person who does not exist” and claimed that the cybercrimes alleged by the United States had nothing to do with North Korea. It called sanctions against the Chosun Expo joint venture company a “farce.” North Korea also accused the United States of spreading falsehoods at a time when the two countries were supposed to be building trust under the joint statement issued at the U.S.–North Korea summit that June.

Nevertheless, the FBI continued to circulate a wanted poster featuring Park Jin Hyok’s photograph, and he remained publicly wanted as of the date of Sisa Journal’s report, November 2, 2026. A senior U.S. Justice Department official said in 2018 that the U.S. government had never discussed his extradition with the North Korean government. The United States has continued to indict North Korean hackers and publicize their identities. In 2024, it offered a reward of up to $10 million for information leading to the arrest of Rim Jong Hyok. Rim is alleged to belong to Andariel, a hacking group under the Reconnaissance General Bureau, and to have hacked defense contractors and NASA, among other targets. Professor Yoon Bong-han of Dongguk University told Sky Daily that it was unclear whether Rim would be arrested in the short term and that he was likely to operate covertly while concealing his identity.

International sanctions also continued. In November 2025, the Australian government designated four organizations and companies—Lazarus Group, Kimsuky, Andariel, and Chosun Expo—as well as Park Jin Hyok himself for financial sanctions, and barred him from entering or staying in Australia. The measures were coordinated with the United States and based on a report by the Multilateral Sanctions Monitoring Team (MSMT), which includes 11 countries, among them South Korea, the United States, and Japan. Australia’s Department of Foreign Affairs and Trade noted that North Korean cybercriminals stole at least A$1.9 billion worth of cryptocurrency in 2024 alone.

## Binance Incident and Renewed Attention

According to Sisa Journal, on November 2, 2026, some foreign media and cryptocurrency outlets reported that the FBI had officially attributed the Binance hack to TraderTraitor, a North Korean hacking group, in coordination with the U.S. Secret Service (USSS) and the IRS Criminal Investigation Division (IRS-CI). These reports also mentioned Park Jin Hyok, and the French cryptocurrency outlet CoinTribune described him as a prominent figure the United States had targeted on cyber-conspiracy charges.

However, Park Jin Hyok’s name does not appear in the FBI’s announcement about the incident. CoinTribune likewise outlined his previous allegations and wanted status but presented no new evidence that he was directly involved in this case.

Blockchain analytics firm Chainalysis estimated that North Korean hackers stole at least $2.02 billion in cryptocurrency in 2025. Sisa Journal noted that the amount stolen in the Binance incident was about 3.1 times that estimate. Kim Heung-gwang, a computer science professor who defected from North Korea, told Al Jazeera in a 2011 interview that training hacking talent was much cheaper than buying new weapons or fighter jets. Sisa Journal interpreted this as a sign that “a second or third Park Jin Hyok” would continue to be trained.

## Authenticity Debate

The central issue is whether the evidence supports calling Park Jin Hyok, an individual charged with hacking offenses, “the world’s most dangerous hacker” and tying him to the mastermind role in a recent incident.

### The Case That He Is a Dangerous Hacker

Those who take this view point to the specific allegations the U.S. government has accumulated against one individual. In 2018, the U.S. Department of Justice filed a criminal complaint linking one person to the Sony, Bangladesh Bank, and WannaCry attacks. In December 2020, it obtained another arrest warrant and expanded the indictment. Treasury sanctions, an FBI wanted notice, and Australia’s independent sanctions followed, so the case is difficult to dismiss as mere speculation. Australia’s measures were based on a report by the Multilateral Sanctions Monitoring Team, which includes 11 countries, meaning the claims do not come from the United States alone.

Some also argue that the scale of the damage makes “the most dangerous” a reasonable description. WannaCry affected computers in more than 150 countries and brought hospital operations to a halt in the United Kingdom. In Bangladesh, $81 million was taken from the central bank. North Korean hackers are also estimated to have stolen at least $2.02 billion in cryptocurrency in 2025 alone, which, they argue, shows that the threat is real. The claim that he is unlikely to be arrested is not without basis either: the United States said it had never discussed his extradition with North Korea, and it would be difficult to obtain custody of him if North Korea continues to deny that he exists.

### The Case That the Claims Are Exaggerated

The opposing view first objects to the conflation of “allegations” with “established facts.” Park Jin Hyok has been indicted and is wanted, but the FBI poster describes the claims against him as allegations. His name came up in connection with the Binance incident not in the FBI’s announcement, but in reports by foreign media and cryptocurrency outlets. As Sisa Journal noted, even CoinTribune offered no new evidence, so describing him as a “suspected mastermind,” as the post does, is an unsupported interpretation. The post put the amount stolen at “more than 1 trillion yen,” while Sisa Journal reported $6.3 billion (about 8.4 trillion won), so even the figures do not match.

Several other claims added by the post cannot be confirmed through other sources. The claim that the U.S. government had “confirmed” the stolen funds were being used for nuclear weapons, strategic missiles, AI-equipped drones, and destroyers capable of launching nuclear cruise missiles does not appear in other reports. The post says he is fluent in Bengali as well, but the languages listed on the FBI poster are only English, Korean, and Chinese. The Bengali claim appears to be unsubstantiated hearsay, with no clear source. The poster, in fact, alleges that he was part of a broad criminal conspiracy carried out by a hacker group affiliated with the Reconnaissance General Bureau. Critics also argue that portraying one person as the world’s worst hacker obscures the organized nature of these operations. Separate from North Korea’s claim that he is “a person who does not exist,” questions remain because the United States has said only that his last known location was North Korea, without specifying where he is now.

The two sides’ positions are not entirely at odds. Both acknowledge that he is a hacking suspect indicted in the United States and has been wanted for eight years. His direct connection to the Binance incident and the description “the world’s most dangerous” remain insufficiently supported.

## Trivia

- The suspicion that North Korea hacked Sony Pictures arose in connection with *The Interview*, a film that included a scene showing the North Korean leader naked, the BBC reported. North Korean state media warned of “merciless retaliation” at the time, The Guardian reported.
- The headline of The Guardian article put the word “hacker” in single quotation marks when referring to Park Jin Hyok.
- The image in the post is a screenshot of the FBI wanted poster. The poster lists several aliases alongside the name Park Jin Hyok, including Jin Hyok Park, Pak Jin Hyok, and Pak Kwang Jin.

## Sources

- FM Korea post, [“North Korean Man Called the World’s Most Dangerous Hacker, Wow.JPG”](https://m.fmkorea.com/best/10512490962)
- Sisa Journal, [“North Korean ‘Hacker’ Park Jin Hyok, Wanted for Eight Years, Back in the Spotlight After Binance Incident”](https://www.sisajournal.com/news/articleView.html?idxno=392603) (2026-11-02)
- Sky Daily, [“Why It’s Difficult to Arrest North Korean Hacker Wanted by the FBI for $10 Million”](https://www.skyedaily.com/news/news_view.html?ID=241009) (2024-07-28)
- The Guardian, [“North Korean ‘hacker’ charged over cyber-attacks against NHS”](https://www.theguardian.com/world/2018/sep/06/us-doj-north-korea-sony-hackers-chares) (2018-09-06)
- BBC, [“North Korea claims NHS and Sony hack suspect ‘doesn’t exist’”](https://www.bbc.com/news/world-asia-45522654) (2018-09-14)

## Verified facts

- The U.S. Department of Justice indicted North Korean national Park Jin Hyok for allegedly participating in the 2014 Sony Pictures hack, the 2016 theft of $81 million from Bangladesh Bank, and the 2017 WannaCry ransomware attack. The Guardian, BBC, Sisa Journal, and the FM Korea post all report this.
- The criminal complaint against Park Jin Hyok was unsealed on September 6, 2018. The Guardian and BBC give the date, while Sisa Journal gives September 2018.
- WannaCry affected more than 150 countries and crippled the U.K. National Health Service (NHS). The Guardian and the FM Korea post report this; the BBC also says the U.S. alleged Park created the malware that crippled the NHS.
- The U.S. Department of Justice considers Park Jin Hyok to be linked to a hacking organization under the North Korean government. An FBI wanted poster included in the FM Korea post identifies the Reconnaissance General Bureau (RGB), while the BBC mentions Bureau 110, also known as the Lazarus Group. Sisa Journal reports that Park worked in Dalian, China, for a front company called Chosun Expo.
- The FBI publicly sought Park Jin Hyok, whose last known location is North Korea. The Guardian reported that he was believed to have operated from China, but prosecutors considered him to be in North Korea at the time. The FBI poster in the FM Korea post and Sisa Journal also say he had traveled to and from China in the past.
- The FBI wanted poster says Park Jin Hyok speaks English, Korean, and Chinese, and lists two possible birth years: 1984 and 1981. The FM Korea post and Sisa Journal both report this. The year 1984 is consistent with the age of 34 that The Guardian reported in 2018.
- Arrest warrants for Park Jin Hyok were issued on June 8, 2018, and again in December 2020. The FBI poster in the FM Korea post and Sisa Journal both report this.
- North Korea denied the allegations, saying Park Jin Hyok did not exist. The BBC and Sisa Journal both report this. North Korea’s Foreign Ministry commented via KCNA that he was a “nonexistent person.”
- The U.S. Treasury Department also sanctioned Park Jin Hyok, according to the BBC. Sisa Journal reports that the Australian government separately imposed financial sanctions and an entry ban. (Confirmed by one source only)

## Points of dispute

- Connection to the Binance hack: The FM Korea post says Park Jin Hyok is suspected of masterminding a theft of more than 1 trillion yen from Binance. Sisa Journal reports that the FBI attributed the Binance hack to the North Korean group TraderTraitor, but that Park was not named in the announcement and no new evidence of his direct involvement was presented. The reported losses also differ: the FM Korea post says more than 1 trillion yen, while Sisa Journal gives $6.3 billion (about 8.4 trillion won).
- Park Jin Hyok’s location: The Guardian said he was once believed to have operated from China but was thought to be in North Korea at the time. The FM Korea post states categorically that he lives in North Korea. Sisa Journal says only that North Korea was his last known location according to the FBI poster.
- Use of the stolen funds: The FM Korea post claims the U.S. government confirmed that the money was used to develop nuclear weapons, missiles, AI drones, and destroyers. This has not been confirmed by Sisa Journal, The Guardian, or the BBC.