Binance Theft Worth About a Sixth of North Korea’s Income, Analyst Says

SEOUL, South Korea – The $6.3 billion in crypto stolen from Binance, a theft the FBI has blamed on North Korea, is equal to roughly one-sixth of North Korea’s annual national income, according to an analyst at a South Korean state defence think tank. Pyongyang has denied involvement.

Attribution and reimbursement

In a statement on October 31, the FBI said North Korean actors were laundering the stolen assets mainly by converting them into Ethereum, and attributed the attack to TraderTraitor, the group it also blamed for a $1.5 billion theft from Bybit in February 2025, Al Jazeera reported.

The agency asked virtual asset service providers to block transactions linked to addresses it listed.

Binance said it had replaced 90% of the stolen amount by buying tokens with company money, drawing on its $1 billion Secure Asset Fund for Users, part of its Futures Insurance Fund and its corporate treasury. The remaining 10% consists of less liquid tokens that may take longer to buy.

“Binance will absorb the financial impact of these stolen funds, not our users,” the company said. Co-chief executive Richard Teng described the breach as a “complex attack” involving a compromised laptop and malicious software designed to delete evidence.

Scale of the theft

Lee Ho-ryung, a senior research fellow at the Korea Institute for Defense Analyses (KIDA), told CNA that North Korea’s exports last year were only around $420 million to $430 million. “In hacking, it’s number one,” Lee said, adding that North Korea selects children gifted in maths and science early for intensive training.

South Korea’s military estimates North Korea’s cyber force at about 8,400 personnel, up around 20% in two years. Pyongyang reorganised its hacking units this year, giving its Reconnaissance General Bureau more cyber capabilities, CNA reported.

A multinational sanctions monitoring report published in October 2025 found that North Korea launders stolen crypto before converting it to cash through overseas brokers in countries including China, Russia and Cambodia. Analysts say such thefts may help fund weapons programmes, which are under international sanctions.

Why it matters

The size of the theft puts state-linked hacking among the main operational risks for crypto exchanges and the firms that serve them.

Binance’s ability to cover most of the loss from its own reserves limited the impact on users, but the episode is likely to add pressure on exchanges to strengthen device security, transaction screening and cooperation with law enforcement on laundering routes.

Sources

• CNA: How hacking became a key weapon for sanctions-hit North Korea
• Al Jazeera: FBI blames North Korea for record $6.3bn crypto heist from Binance