FBI Says North Korea Behind $6.3B Binance Hack, Seeks Help

The FBI has attributed a major cryptocurrency theft tied to North Korea to a specific pattern of malicious activity it calls “TraderTraitor.” In an alert released this week, the agency said it believes North Korean-linked actors were responsible for the theft of about $6.3 billion in digital assets from crypto exchange Binance on Thursday.

The FBI said it most recently observed TraderTraitor converting stolen funds primarily into Ether (ETH). It also expects the hackers to move into more advanced laundering stages, including the use of decentralized finance (DeFi) and instant swap services.

Key takeaways

• The FBI attributes roughly $6.3 billion stolen from Binance on Thursday to North Korea-linked activity branded “TraderTraitor.”
• According to the FBI, the group’s recent behavior has involved converting stolen assets largely into ETH before further laundering.
• The FBI expects additional use of DeFi and instant swaps as funds progress through later stages of obfuscation.
• Businesses across the crypto stack are urged to block transactions involving addresses associated with TraderTraitor laundering.
• The event fits a broader pattern of North Korea using stolen crypto as off-budget financing, including to support weapons and WMD-related programs.

FBI alert targets laundering infrastructure

In a news release, the FBI urged private-sector entities to take immediate steps to disrupt the flow of stolen funds. The agency called on THORNode operators, RPC node operators, instant exchange platforms, DeFi services, blockchain analytics providers, and other digital asset businesses to block transactions involving addresses used by TraderTraitor actors or addresses derived from them.

The FBI provided a full list of affected addresses in its release, signaling an emphasis not just on identifying the attackers, but also on practical countermeasures by infrastructure operators that can reduce the likelihood that stolen assets successfully move through the ecosystem.

The operational focus matters for markets and users because crypto laundering often depends on speed and liquidity—actors frequently try to route assets through multiple platforms and services before enforcement and monitoring can catch up. By asking counterparties to block specific addresses, the FBI is effectively coordinating private compliance actions with law enforcement objectives.

Why “TraderTraitor” matters for the next stage of enforcement

The FBI’s characterization of TraderTraitor is notable for what it implies about the attackers’ playbook. The agency said it has observed the group converting stolen assets mostly into ETH, and then pushing proceeds toward further laundering through DeFi and instant swaps.

That sequencing highlights a common pattern in large crypto thefts: once assets are liquid enough (or can be made liquid quickly), attackers aim to spread activity across decentralized and fast-settlement venues that can make tracing harder. If the FBI’s expectations are correct, the immediate risk is not only that funds have been stolen, but that they can be processed through systems that are traditionally harder to monitor than centralized account databases.

For operators and service providers, the FBI’s request also reflects a shift from generalized alerts toward address-based operational remediation—meaning the threat is being translated into concrete steps that can be implemented through monitoring and transaction controls.

North Korea’s role in crypto theft remains a recurring theme

This is not the first time investigators have pointed to North Korea-linked actors in the context of major crypto losses. Earlier in 2026, Cointelegraph reported—citing data referenced by the original reporting—that North Korea-linked hackers were responsible for about 60% of the value lost to crypto hacks in 2025, with proceeds used to support the regime’s nuclear and ballistic missile programs.

That assessment aligns with a CertiK report referenced in the earlier coverage. CertiK attributed more than $2 billion of an estimated $3.4 billion in 2025 crypto security losses to groups tied to North Korea, across 79 incidents out of 656 documented during the year.

While North Korea does not publish credible public budget figures, the article referenced independent research from MilitarySpend, which uses purchasing-power-adjusted GDP estimates to suggest mid-range consensus defense spending of up to around $6 billion annually—though the figure remains uncertain.

MilitarySpend also points to the idea that non-transparent revenue streams can supplement weapons programs. As described in the referenced reporting, revenue from Russia arms transfers and proceeds from cryptocurrency theft can provide additional off-budget financing for weapons development, including WMD-related efforts.

Cointelegraph previously reported that, between 2016 and early 2026, North Korea-linked actors stole an estimated $6.75 billion across 263 documented incidents, citing CertiK analysis that in turn referenced independent on-chain researcher Taylor Monahan. CertiK’s conclusion, as reported, was that North Korea has industrialized crypto theft into a core state revenue mechanism.

What to watch next after the Binance attribution

With the FBI urging infrastructure providers and DeFi participants to block transactions tied to TraderTraitor-related addresses, the next developments will likely center on whether service providers rapidly implement the recommended controls and whether attackers can successfully convert and route remaining balances before additional restrictions take effect. Investors and builders should pay close attention to how quickly exchange, node, and DeFi partners respond to the address list—and whether laundering patterns shift toward new venues if older paths become blocked.