The FBI said North Korea was responsible for the theft of approximately $6.3 billion in digital assets from cryptocurrency exchange Binance on Thursday. In a Saturday news release, the agency identified the specific activity as “TraderTraitor,” a label it uses for North Korean malicious cyber operations.
According to the FBI, the attackers have mainly been converting the stolen assets into Ether. The agency expects the funds to move through decentralized finance platforms and instant swap services as the operators advance their laundering efforts.
The FBI called on private-sector companies to help disrupt the transfers. Its appeal included THORNode and RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other digital-asset providers. These entities were asked to block transactions involving, or originating from, addresses allegedly used by TraderTraitor actors. The agency said its release contains a complete list of the relevant addresses.
The disclosure follows other estimates highlighting the scale of North Korea-linked cryptocurrency theft. A CertiK report cited in the source attributed more than $2 billion of an estimated $3.4 billion lost in crypto security incidents during 2025 to groups linked to North Korea. Those losses came across 79 of the 656 incidents documented that year.
Separate estimates cited by the source put the total amount stolen by North Korea-linked actors between 2016 and early 2026 at approximately $6.75 billion across 263 documented incidents. CertiK concluded that cryptocurrency theft had become a core state revenue mechanism for North Korea.
The source also cited MilitarySpend estimates placing North Korea’s annual defense spending as high as $6 billion, although the figure remains uncertain. Revenue from arms transfers to Russia and cryptocurrency theft were described as additional funding sources for the country’s weapons programs.
Sources: Cointelegraph.