FBI Blames North Korea for $6.3B Binance Hack, Names TraderTraitor

The FBI has formally blamed North Korea for stealing roughly $6.3 billion in digital assets from Binance, in what it's describing as the largest crypto hack on record. The attribution came in a news release issued Saturday, tied to a theft that took place on Thursday.

The bureau is calling this specific campaign "TraderTraitor," a label it has used for years to track North Korea-linked hacking operations. According to the FBI, the hackers have most recently been observed converting the bulk of the stolen funds into Ether (ETH) rather than holding them in their original form.

Laundering through DeFi and instant swaps

The FBI expects the stolen assets to keep moving through DeFi protocols and instant swap services as the hackers advance to more sophisticated laundering stages. Instant swap services let users exchange crypto quickly without strict identity verification, which makes them a convenient tool for obscuring where funds came from. DeFi, short for decentralized finance, refers to financial protocols running on smart contracts without a centralized intermediary, which makes tracking and blocking transactions considerably harder than on a regular exchange.

Because of this pattern, the FBI is leaning on the private sector for help. It specifically called on THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other digital asset service providers to block transactions tied to the addresses TraderTraitor is using. THORNodes run the THORChain network, a non-custodial cross-chain swap protocol frequently used to move assets between different blockchains without going through a centralized exchange. The FBI included a full list of the relevant addresses in its release.

Part of a longer pattern, not an isolated case

The Binance theft adds to a long list of large-scale crypto heists tied to North Korea. Cointelegraph previously reported that North Korea-linked hackers accounted for about 60% of total value lost to crypto hacks in 2025, with the proceeds helping fund the regime's nuclear and ballistic missile programs.

That figure came from a report by security firm CertiK, which attributed more than $2 billion of an estimated $3.4 billion in 2025 crypto security losses to groups tied to North Korea. Those losses were spread across just 79 of 656 documented security incidents that year, meaning North Korea-linked actors were behind only about 12% of incidents but absorbed more than half the dollar value lost, a sign their operations tend to target high-value hits rather than running up a large number of smaller attacks.

Looking further back, CertiK, citing independent onchain researcher Taylor Monahan, found that between 2016 and early 2026, North Korea-linked actors stole an estimated $6.75 billion in cryptocurrency across 263 documented incidents. The $6.3 billion Binance hack alone comes close to matching their entire cumulative haul over roughly a decade, underscoring how far this single incident stands out from their historical average. CertiK concluded that North Korea has industrialized crypto theft into a core state revenue mechanism.

Why North Korea leans on crypto theft

North Korea doesn't publish credible budget data for the outside world. Independent research organization MilitarySpend places the mid-range consensus estimate of the country's actual annual defense spending at as much as $6 billion, based on purchasing-power-adjusted GDP estimates, though the figure remains uncertain given the lack of official disclosures.

MilitarySpend adds that revenue from arms transfers to Russia also supplements the regime's weapons programs. South Korean intelligence estimates North Korea exported as much as $5 billion worth of munitions to Russia between 2022 and 2025. On top of that official channel, crypto theft provides an additional stream of off-budget financing for weapons of mass destruction development, one that's notoriously hard to trace through conventional financial channels given how easily crypto can cross borders and get obscured through mixers or DeFi.

Trump says he's not worried

Amid the FBI's findings, President Donald Trump said he is "not concerned" about the hack, according to a Firstpost report. It's not clear from available reporting whether that comment ties into any new policy response toward North Korea or was simply a brief reaction to the news.

What it means for traders

For traders and exchange users, the most concrete thing to track right now is the FBI's published list of TraderTraitor-linked addresses. Anyone using DeFi platforms, instant swap services, or cross-chain bridges should check whether those platforms have implemented the blocking the FBI requested, since funds that get mixed with the stolen assets risk being flagged or frozen by other exchanges down the line.

On price action, the incident hasn't triggered a visible macro shock to Bitcoin or Ether so far. But large ETH flows from TraderTraitor-linked addresses could add onchain sell pressure at any point if the laundering keeps running through DeFi. It's also worth watching liquidity on instant swap platforms and THORChain specifically, since the FBI named both as likely routes for moving the stolen funds.

There's a reputational angle worth tracking too. The case adds regulatory pressure on major exchanges and DeFi protocols seen as lax on transaction screening, pressure that could eventually translate into new compliance rules affecting transaction speed and cost on those platforms.

What is TraderTraitor?

TraderTraitor is the FBI's designation for the North Korea-linked hacking campaign it blames for stealing about $6.3 billion in digital assets from Binance.

Where is the stolen crypto going?

The FBI says the hackers have mostly converted the stolen assets into Ether and expects further laundering through DeFi protocols and instant swap services.

Who did the FBI ask for help?

The bureau asked THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other digital asset providers to block transactions tied to the addresses it listed.

How much crypto has North Korea stolen in total?

CertiK, citing researcher Taylor Monahan, estimates North Korea-linked actors stole $6.75 billion in crypto across 263 documented incidents between 2016 and early 2026.