The FBI has officially attributed the record $6.3 billion Binance hack to North Korean cybercriminals, raising fresh concerns about cryptocurrency security and the use of stolen digital assets to finance the country’s military programs.
In a statement released on Saturday, October 31, the US Federal Bureau of Investigation identified North Korea’s TraderTraitor hacking operation as responsible for the massive cryptocurrency theft that occurred on Thursday.
US authorities are now seeking assistance from cryptocurrency companies and blockchain service providers to prevent the stolen funds from being laundered through decentralized financial platforms.
FBI Identifies North Korea’s TraderTraitor Group in Binance Hack
According to the FBI, the cyberattack against Binance was carried out by malicious actors linked to the Democratic People’s Republic of Korea (DPRK).
The agency identified the operation as TraderTraitor, a North Korean hacking campaign associated with sophisticated cryptocurrency theft and money laundering activities.
Investigators have observed the hackers converting a significant portion of the stolen digital assets into Ethereum (ETH).
Authorities expect the attackers to continue moving these funds through decentralized finance (DeFi) platforms and instant cryptocurrency exchange services.
These transactions could make it increasingly difficult for investigators to track the stolen assets and prevent their movement across blockchain networks.
FBI Urges Crypto Companies to Block Stolen Funds
The FBI is calling on businesses throughout the cryptocurrency industry to help disrupt the laundering of assets stolen during the Binance security breach.
The agency specifically requested cooperation from THORNode operators, remote procedure call (RPC) node operators, instant cryptocurrency exchanges, DeFi platforms, and blockchain analytics companies.
Other digital asset service providers have also been encouraged to identify and block transactions connected to wallets controlled by the TraderTraitor operation.
To support these efforts, the FBI published a list of cryptocurrency wallet addresses associated with the attackers.
The addresses include wallets believed to hold stolen assets or to have previously facilitated transactions involving the illicit funds.
By coordinating with private-sector companies, US authorities hope to restrict the hackers’ ability to move, exchange, and conceal the stolen cryptocurrency.
North Korean Hackers Accounted for 60% of Crypto Theft Losses in 2025
The Binance hack follows years of increasingly sophisticated cyberattacks attributed to North Korean hacking organizations.
According to blockchain security company CertiK, North Korea-linked hackers were responsible for approximately 60% of the total value stolen through cryptocurrency security breaches in 2025.
The company’s research estimated that cryptocurrency-related security incidents generated approximately $3.4 billion in losses worldwide during that year.
Of this amount, more than $2 billion was attributed to cybercriminal groups connected to North Korea.
The report identified 79 North Korea-linked incidents among the 656 cryptocurrency security breaches documented throughout 2025.
Although these attacks represented a relatively small percentage of overall incidents, they accounted for a disproportionately large share of financial losses.
The findings suggest that North Korean cybercriminals increasingly concentrate on high-value cryptocurrency targets rather than relying solely on large numbers of smaller attacks.
Stolen Cryptocurrency Could Help Finance North Korea’s Military Programs
The growing scale of North Korean cryptocurrency theft has also raised concerns about the potential use of stolen digital assets to support the country’s defense industry.
Security researchers have previously warned that proceeds from cybercrime may provide additional financing for North Korea’s nuclear weapons and ballistic missile programs.
Estimating the country’s military expenditure remains difficult because North Korea does not publish reliable and independently verifiable defense budget figures.
However, research organization MilitarySpend estimates that annual defense spending could reach approximately $6 billion under certain purchasing-power-adjusted calculations.
The organization also highlights North Korea’s military cooperation with Russia as another potential source of financial support.
According to estimates attributed to South Korean intelligence, North Korea exported as much as $5 billion worth of ammunition and other military supplies to Russia between 2022 and 2025.
These estimates remain uncertain, but they illustrate the various sources of funding potentially available to the country’s military programs.
Cryptocurrency theft could provide an additional source of revenue outside conventional government financing channels.
North Korea-Linked Hackers Stole $6.75 Billion Between 2016 and Early 2026
The scale of North Korea’s cryptocurrency operations extends well beyond the latest Binance security breach.
CertiK previously estimated that hacking groups associated with the country had stolen approximately $6.75 billion in digital assets across 263 documented incidents between 2016 and early 2026.
The figures were based on research by independent blockchain investigator Taylor Monahan.
Importantly, these historical estimates predate the October 2026 Binance attack and therefore do not include its reported $6.3 billion in stolen assets.
CertiK’s research concluded that cryptocurrency theft has evolved into a highly organized revenue-generating activity for North Korea.
Rather than operating as isolated cybercriminal groups, the attackers increasingly demonstrate coordinated capabilities involving digital asset theft, blockchain transactions, and sophisticated laundering methods.
Binance Hack Highlights Growing Cryptocurrency Security Risks
The unprecedented Binance attack underscores the financial and security challenges facing cryptocurrency exchanges and the broader digital asset industry.
Although blockchain networks employ advanced cryptographic security, cryptocurrency businesses remain vulnerable to cyberattacks targeting their infrastructure, employees, and operational systems.
The FBI’s efforts to coordinate with private-sector companies highlight the importance of cooperation between law enforcement agencies, exchanges, and blockchain analytics providers.
Meanwhile, investigators will continue monitoring suspicious cryptocurrency transactions as they attempt to prevent the stolen funds from entering the wider financial system.
The outcome could have significant implications for cryptocurrency security standards, anti-money laundering measures, and international efforts to combat state-linked cybercrime.
