FBI says North Korea was behind Binance’s record $6.3B crypto theft

The FBI says the Democratic People’s Republic of Korea stole about $6.3 billion in digital assets from Binance, and it has already mapped the laundering pattern it wants the industry to block. For PSPs, exchanges, node operators, and analytics firms, the practical point is obvious: the stolen funds are moving through the same plumbing that high-risk crypto businesses rely on every day.

1. The FBI said on Saturday that it refers to this North Korean activity as TraderTraitor. According to the bureau, the group has most recently been converting stolen assets mostly into Ether (ETH), with further conversion expected through DeFi and instant swap services as the laundering process moves into more advanced stages.
2. The agency urged private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other digital asset service providers to block transactions with or derived from the addresses TraderTraitor actors are using to launder the stolen assets. The FBI said a full list of addresses is included in its news release.
3. Cointelegraph reported earlier this year that North Korea-linked hackers stole about 60% of the value lost to crypto hacks in 2025, with proceeds used to help fund the regime’s nuclear and ballistic missile programs. That report cited a growing reliance on digital assets to generate hard currency.
4. Those figures came from a CertiK report that attributed more than $2 billion of an estimated $3.4 billion in 2025 crypto security losses to groups tied to North Korea, across 79 of 656 incidents documented that year. CertiK’s broader analysis said North Korea-linked actors stole an estimated $6.75 billion in cryptocurrency across 263 documented incidents between 2016 and early 2026.
5. MilitarySpend, an independent research organization, said mid-range consensus places North Korea’s actual annual defense spending at as much as $6 billion, using purchasing-power-adjusted GDP estimates, though the figure is uncertain. The same source said revenue from Russia arms transfers — estimated at as much as $5 billion in munitions exported to Russia from 2022-2025 per South Korean intelligence — supplements domestic weapons programs, alongside cryptocurrency theft.

CertiK concluded that North Korea has industrialized crypto theft into a core state revenue mechanism. For payment firms and crypto infrastructure providers, that means sanctions screening, address monitoring, and transaction filtering are not side tasks; they are part of staying out of the laundering path.