The United States Federal Bureau of Investigation (FBI) has stated that North Korea is responsible for the theft of roughly $6.3 billion in digital assets from crypto exchange Binance on Thursday, Oct. 29, 2026. In a press release on Saturday, the law enforcement agency identified the state-sponsored hacking group as TraderTraitor. The collective was previously tied to the $1.5 billion Bybit exchange exploit in February 2025.
Investigators have begun mapping the path of the stolen funds. FBI observations indicate that TraderTraitor actors have largely swapped the looted assets into Ether (ETH). Investigators estimate that the group is preparing to proceed to the next phase of money laundering via decentralized finance (DeFi) protocols and instant swap exchanges.
Blockades Across DeFi Protocols
In response to the capital movement, the FBI issued an urgent appeal to private sector participants to cut off transaction pathways. The advisory was directed at THORNode operators, RPC node operators, instant swap exchanges, DeFi protocols, and on-chain analytics firms. All entities were urged to block all transactions flowing to and from the officially published list of hacker wallet addresses.
Preventive measures have already started at the network level. The Arbitrum Security Council executed an emergency transaction to freeze approximately $30.5 million tied to the hacker address 0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5.
How Much Pyongyang Has Plundered
The Binance breach extends the record of cyber operations carried out by Pyongyang-backed groups across the crypto market. Security data from CertiK indicates that North Korea-affiliated hackers accounted for 60% of all global crypto hack losses throughout 2025. Out of the industry’s $3.4 billion total losses that year, the group plundered over $2 billion across just 79 incidents.
Over a longer timeline, the cumulative haul is even more substantial. On-chain research by Taylor Monahan alongside CertiK estimates North Korea’s total cyber theft from 2016 through early 2026 reached $6.75 billion across 263 incidents. Digital asset theft has developed into a central state revenue mechanism for Pyongyang.
Funding Weapons Programs Outside the Official Budget
The proceeds of these cybercrimes are directly tied to North Korea’s military financing. According to MilitarySpend estimates, revenue from digital asset theft is utilized to fund the defense budget and weapons of mass destruction (WMD) programs. Stolen crypto exchange proceeds operate outside Pyongyang’s official defense budget, which is estimated at $6 billion annually.
The blacklist circulated by the FBI is now testing the decentralized ecosystem’s readiness to intercept illicit fund flows. The freeze implemented by Arbitrum demonstrates that rapid action at the protocol level can restrict attacker movements, but containing the remaining billions depends on the speed of cross-platform coordination across the broader industry.
Reported by Cointelegraph.
Previously: North Korean Hackers Behind 89% of 2026 Crypto Losses - Total Haul Reaches $13.24 Billion
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
