The Federal Bureau of Investigation (FBI) stated that North Korea was responsible for stealing around $6.3 billion in digital assets from cryptocurrency exchange Binance. The enforcement agency identified the specific malicious cyber activity as “TraderTraitor,” which primarily targets digital asset platforms to steal user funds.
TraderTraitor and the North Korean cyber tactics
According to the FBI, the TraderTraitor group has recently focused on converting stolen assets primarily to Ether (ETH). Investigators expect the hackers to continue laundering these funds through decentralized finance (DeFi) platforms and instant swap services as they move to more advanced stages to obscure the digital trail.
The FBI called on private sector actors, including THORNode operators, RPC node operators, instant exchanges, DeFi services, and blockchain analytics companies, to identify and block transactions linked to TraderTraitor addresses. The agency released a full list of these addresses to support industry efforts to prevent further movement and laundering of illicit assets.
Mini dictionary: TRADERTRAITOR – A term used by the FBI to describe a North Korean cybercrime group that conducts sophisticated malware and phishing operations to target and steal digital assets, particularly from cryptocurrency exchange platforms. The group is known for laundering stolen funds via DeFi protocols and instant asset-swapping services to obfuscate the origin of the funds.
Scale of North Korean crypto theft
Earlier this year, blockchain security firm CertiK reported that hackers linked to North Korea were responsible for approximately 60% of all crypto theft losses in 2025. According to CertiK’s data, North Korean groups stole more than $2 billion in digital assets that year, out of a total $3.4 billion lost. These proceeds reportedly contributed to funding the country’s nuclear and ballistic missile programs, highlighting North Korea’s increasing reliance on stolen cryptocurrency for generating hard currency amid international sanctions.
Between 2016 and early 2026, North Korea-linked actors stole an estimated $6.75 billion in cryptocurrency across 263 incidents, according to CertiK and onchain researcher Taylor Monahan. CertiK concluded that North Korea has industrialized cryptocurrency theft as a central source of state revenue.
| Year | Total Crypto Losses | Losses Attributed to North Korea | Number of Incidents |
|---|---|---|---|
| 2025 | $3.4 billion | $2 billion | 79 |
| 2016–2026 (to date) | – | $6.75 billion | 263 |
North Korea’s defense funding and global implications
MilitarySpend, an independent research organization, noted that current estimates of North Korea’s annual defense spending could reach as high as $6 billion, though this figure remains uncertain due to the country’s limited economic transparency. In addition to cryptocurrency theft, MilitarySpend reported that arms transfers to Russia are providing supplementary income for North Korea’s domestic weapons programs.
South Korean intelligence estimated that munitions worth up to $5 billion have been exported to Russia from 2022 to 2025. These transfers, along with off-budget financing through cyberattacks and digital asset thefts, are believed to support the country’s continued development of weapons of mass destruction.
CertiK’s analysis found that North Korea relies on industrial-scale cryptocurrency theft as a key strategy for circumventing sanctions and financing its weapons programs.
