North Korea behind massive $6.3B cryptocurrency heist from Binance, FBI confirms
Federal investigators request assistance from private companies to prevent continued laundering of pilfered cryptocurrency holdings.
Federal investigators have announced that the Democratic People's Republic of Korea (North Korea) stands behind the massive theft of approximately $6.3 billion worth of cryptocurrency from the Binance exchange platform, which occurred this past Thursday.
In a statement released Saturday, the FBI revealed that it has designated this particular North Korean cyber campaign as "TraderTraitor," noting that investigators have recently tracked the stolen cryptocurrency being primarily converted into Ether (ETH) tokens.
Federal authorities anticipate that the pilfered digital currency will undergo additional conversion through decentralized finance platforms and instant swap mechanisms as the cybercriminals progress toward more sophisticated money laundering operations.
The federal agency has called upon private industry participants, specifically THORNode operators, RPC node operators, instant exchange platforms, decentralized finance services, blockchain analytics companies, and various digital asset service providers, to prevent transactions involving or originating from wallet addresses being utilized by TraderTraitor operatives for laundering the stolen cryptocurrency. The statement includes a comprehensive listing of these addresses.
Earlier reporting by Cointelegraph this year revealed that cybercriminals linked to North Korea were responsible for approximately 60% of total losses from cryptocurrency hacks throughout 2025, with the illicit gains being channeled toward financing the regime's nuclear weapons and ballistic missile initiatives, underscoring an increasing dependence on digital currencies for generating foreign currency reserves.
North Korean defense spending supplemented
These conclusions originated from a comprehensive CertiK analysis that linked over $2 billion of a total estimated $3.4 billion in cryptocurrency security breaches during 2025 to organizations with North Korean connections, representing 79 separate attacks out of 656 total incidents recorded throughout that year.
Although North Korea fails to release reliable budget information, the independent research organization MilitarySpend suggests that mid-range estimates position the country's actual yearly defense expenditures at approximately $6 billion, calculated using purchasing-power-adjusted GDP methodology, though considerable uncertainty surrounds this estimate.
According to MilitarySpend's assessment, income generated from Russian arms transactions — calculated at roughly $5 billion worth of munitions shipped to Russia during the 2022-2025 period according to South Korean intelligence agencies — provides additional funding for domestic weapons initiatives, alongside cryptocurrency theft operations, which furnish extra off-the-books financing for weapons of mass destruction development programs.
Previous Cointelegraph coverage indicated that from 2016 through the beginning of 2026, cybercriminals with North Korean ties successfully stole roughly $6.75 billion in digital currencies across 263 documented security breaches, based on CertiK data citing research conducted by independent blockchain investigator Taylor Monahan.
The analytical assessment from CertiK determined that North Korea has transformed cryptocurrency theft operations into an industrialized, fundamental component of state revenue generation.