FBI Attributes Record $6.3 Billion Binance Hack to North Korea

The FBI formally attributed the theft of roughly $6.3 billion in digital assets from cryptocurrency exchange Binance to North Korea, in a news release issued Saturday. The bureau confirmed the hack occurred Thursday and identified the perpetrators as state-sponsored cyber actors operating under its tracking designation "TraderTraitor."

The attribution escalates what is already the largest crypto theft on record into a matter of US national security. The FBI said it has most recently observed TraderTraitor actors converting the stolen assets predominantly into Ether (ETH). It expects further conversion through DeFi protocols and instant swap services as the laundering operation moves into more advanced stages.

The bureau did not stop at attribution. It issued a direct call to the private sector, urging a broad set of intermediaries to interdict the flow of funds.

The entities named in the request include:

• THORNode operators
• RPC node operators
• Instant exchanges
• DeFi services
• Blockchain analytics firms
• Other digital asset service providers

Each was asked to block transactions with, or derived from, the addresses TraderTraitor actors are using to launder the stolen assets. The FBI published a full list of those addresses alongside the release, effectively turning infrastructure operators into the first line of defense.

How does this fit North Korea's wider crypto operation?

The scale is not an outlier. It is a pattern. Cointelegraph reported earlier this year that North Korea-linked hackers accounted for about 60% of the total value lost to crypto hacks in 2025, with proceeds helping fund the regime's nuclear and ballistic missile programs.

A CertiK report attributed more than $2 billion of an estimated $3.4 billion in 2025 crypto security losses to North Korea-tied groups, spread across 79 of 656 documented incidents. A related CertiK analysis, citing independent on-chain researcher Taylor Monahan, found that between 2016 and early 2026, North Korea-linked actors stole an estimated $6.75 billion in cryptocurrency across 263 documented incidents.

CertiK's conclusion is blunt: North Korea has industrialized crypto theft into a core state revenue mechanism.

What does this change for operators and exchanges?

The practical burden now falls on infrastructure providers. Node operators and instant swap services sit at the exact layer where the FBI says laundering is happening, and the published address list gives them an actionable screening baseline. Firms that fail to act against flagged addresses face mounting exposure, as sanctions and law enforcement scrutiny tighten around any touchpoint in the laundering chain.

The geopolitical stakes sharpen the picture. North Korea does not publish credible budget data, but independent research organization MilitarySpend places mid-range consensus estimates of its actual annual defense spending at as much as $6 billion, using purchasing-power-adjusted GDP figures, though that number is uncertain.

MilitarySpend notes that crypto theft is not the only off-budget funding stream. Revenue from Russia arms transfers — estimated at as much as $5 billion in munitions exported to Russia from 2022 to 2025, per South Korean intelligence — also supplements domestic weapons programs, as does stolen digital assets, which provide additional financing for weapons of mass destruction development.

For Binance, the operational consequence is twofold: an unprecedented recovery effort and a permanent stain on its security record. For the broader market, the incident confirms that nation-state actors now treat exchanges and DeFi rails as extractable state revenue.

Expect the enforcement window to stay open. With the FBI's address list now public and laundering still in active stages, the coming weeks will test whether private-sector coordination can freeze a meaningful share of $6.3 billion before it disappears into final cash-out channels.