The FBI said the Democratic People's Republic of Korea (DPRK), commonly known as North Korea, was responsible for the theft of roughly $6.3 billion in digital assets from cryptocurrency exchange Binance on Thursday.

In a news release issued on Saturday, the FBI said it designates the malicious cyber activity “TraderTraitor” and has most recently observed the actors converting stolen assets mostly into Ether (ETH). The bureau expects the funds to be converted further through DeFi services and instant swap platforms as the hackers advance to more sophisticated laundering stages. The FBI's published address list gives those channels a concrete screening reference as the funds move, and whether the named services enforce the requested blocks is the immediate development to watch.

The FBI urged private sector entities — including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other digital asset service providers — to block transactions with, or derived from, the addresses TraderTraitor actors are using to launder the stolen assets. A full list of the addresses is provided in the news release. Because the alert covers funds “derived from” the flagged addresses — not only direct transfers — it reaches across the broad cross-section of intermediaries the bureau named, from node operators to analytics firms.

Crypto theft as state financing

Earlier this year, Cointelegraph reported that North Korea-linked hackers stole about 60% of the value lost to crypto hacks in 2025, with proceeds used to help fund the regime's nuclear and ballistic missile programs, highlighting a growing reliance on digital assets to generate hard currency.

Those findings came from a CertiK report that attributed more than $2 billion of an estimated $3.4 billion in 2025 crypto security losses to groups tied to North Korea, across 79 of the 656 incidents documented that year.

North Korea does not publish credible budget data, but independent research organization MilitarySpend said mid-range consensus places the country's actual annual defense spending at as much as $6 billion, based on purchasing-power-adjusted GDP estimates — a figure that remains uncertain.

MilitarySpend added that revenue from arms transfers to Russia supplements domestic weapons programs, with South Korean intelligence estimating as much as $5 billion in munitions exported to Russia from 2022 through 2025. Cryptocurrency theft likewise contributes, providing additional off-budget financing for weapons of mass destruction (WMD) development.

According to CertiK, citing findings by independent on-chain researcher Taylor Monahan, North Korea-linked actors stole an estimated $6.75 billion in cryptocurrency across 263 documented incidents between 2016 and early 2026. For scale, the $6.3 billion taken from Binance is nearly as large as that decade-long cumulative estimate, and it is comparable to MilitarySpend's estimate of as much as $6 billion in annual defense spending. CertiK's analysis concluded that North Korea has industrialized crypto theft into a core state revenue mechanism.