FBI Attributes $6.3 Billion Binance Crypto Heist to North Korean Hackers

In a Saturday press release, the FBI labeled this specific malicious cyber operation by North Korea as “TraderTraitor,” noting their recent activities predominantly involve converting the stolen funds into Ether (ETH).

The agency anticipates that the hackers will further launder the assets using decentralized finance (DeFi) platforms and instant swap services, advancing into more sophisticated money laundering stages.

The FBI urged private sector entities—including THORNode operators, RPC node operators, instant exchange services, DeFi platforms, blockchain analytics companies, and other digital asset service providers—to block all transactions linked to addresses used by TraderTraitor actors to launder the stolen cryptocurrencies. A comprehensive list of these addresses was provided in the FBI’s announcement.

Earlier this year, Cointelegraph reported that North Korean hackers were responsible for roughly 60% of the total cryptocurrency thefts in 2025. The proceeds from these hacks are believed to fund the regime’s nuclear and ballistic missile programs, highlighting an increasing dependence on digital currencies for acquiring hard cash.

These findings come from a CertiK report attributing over $2 billion of the estimated $3.4 billion in crypto security losses in 2025 to North Korea-affiliated groups across 79 of the 656 documented incidents for that year.

North Korea does not release reliable budget data. However, according to the independent research group MilitarySpend, consensus estimates place the country’s annual defense spending at up to $6 billion when adjusted for purchasing power, though this number remains approximate.

MilitarySpend also notes that North Korea’s military programs are supplemented not only by these cyber thefts but also by arms exports to Russia. South Korean intelligence estimates that Russia imported up to $5 billion worth of munitions from North Korea between 2022 and 2025, which, combined with crypto theft proceeds, provides off-budget funding for weapons of mass destruction development.

Between 2016 and early 2026, entities linked to North Korea reportedly stole around $6.75 billion in cryptocurrency across 263 documented hacking events, according to CertiK citing independent blockchain researcher Taylor Monahan.

CertiK’s analysis concluded that North Korea has turned cryptocurrency theft into an industrialized method for generating state revenue.

The revelation that North Korea has systematized large-scale cryptocurrency theft underscores the strategic importance of digital assets in financing its military and weapons programs, posing significant challenges for international cybersecurity and sanctions enforcement.

This case exemplifies how state actors increasingly exploit cutting-edge financial technologies for illicit resource acquisition, emphasizing the need for robust cooperative defenses across public and private sectors.