FBI Accuses North Korea in $6B Binance Theft; U.S. Urges Sanctions

Daniel Okafor

The FBI accused North Korean hackers of stealing more than $6 billion in cryptocurrency from Binance, the central finding behind a U.S. State Department push for coordinated enforcement of existing United Nations sanctions against North Korea.

The request, made in a written response, asks U.N. member states to enforce sanctions already in place. A State Department spokesperson called coordinated action against North Korean cyber activity “critical” and described coordinated unilateral sanctions as “a tool to disrupt funding for weapons proliferation.”

Washington’s stated objective is to stop funds from reaching North Korea’s weapons programs. The State Department said enforcing sanctions would help prevent North Korea from raising money for those programs, tying the Binance theft accusation to a broader funding problem. The response did not announce a separate enforcement action against Binance.

What does the State Department want?

The appeal, as described, centers on enforcing sanctions already in force rather than creating a new sanctions instrument. In operational terms, it calls on national authorities to apply existing measures in coordination. The State Department said the goal was to prevent North Korea from raising money for weapons programs, linking the Binance accusation to a broader funding challenge tied to the government’s cyber operations.

The response establishes four core elements:

• Existing sanctions: The State Department asked U.N. member states to enforce sanctions already in place against North Korea.
• Coordinated response: A State Department spokesperson called coordinated action against North Korean cyber activity “critical.”
• Funding objective: The spokesperson described unilateral sanctions taken in coordination as a tool to disrupt funding for weapons proliferation.
• Theft finding: The FBI attributed more than $6 billion in stolen cryptocurrency to North Korean hackers targeting Binance.

How does Treasury’s action fit?

Earlier, U.S. Treasury sanctioned one company and 10 people connected to a North Korean IT-worker fraud network and cryptocurrency conversions. Treasury said proceeds from the scheme supported North Korea’s weapons of mass destruction and ballistic missile programs. The action covered one company and 10 individuals, although the report did not identify any of them.

The sanctions connect the Binance theft accusation to a broader enforcement track: Treasury targeted actors tied to fraud and cryptocurrency conversions, while the State Department now presses U.N. members to enforce the wider sanctions framework against North Korean cyber activity. That gives Washington an existing enforcement base for its diplomatic push, even though the response did not announce additional designations.

What remains unresolved?

The State Department did not say whether Washington had shared investigative findings with South Korea or held bilateral talks about additional sanctions. South Korea had not begun sanctions talks over the Binance theft.

Those two gaps leave the regional response unresolved. The United States has called on member states to act, while Seoul has not started discussions and Washington has not said whether it shared the FBI findings. For Binance, the immediate consequence is broader government enforcement rather than a new exchange-specific penalty announced in the response.

Operationally, governments now face the task of turning the appeal into action against the company and people Treasury already sanctioned. Greater enforcement could place more pressure on the North Korean fraud and cryptocurrency-conversion network that Treasury said funded weapons programs, while South Korea’s participation remains undecided.

The next checkpoint is whether South Korea opens sanctions discussions and whether other U.N. members announce enforcement steps; the State Department set no deadline in the written response.