FBI confirms North Korea stole $6 billion from Binance, but what can the hackers actually buy?

The FBI has confirmed that North Korea was responsible for stealing more than $6 billion in cryptocurrency from Binance. That’s an almost unimaginable amount of money, even by the standards of major cyberattacks. But there’s something about this particular theft that raises an interesting question.

What exactly does North Korea plan to do with all that money? After all, we’re talking about one of the most isolated countries on Earth.

North Korea faces extensive international sanctions, has limited access to conventional banking, and isn’t exactly known for its thriving consumer economy. It’s not as though a group of hackers in Pyongyang can suddenly start ordering Lamborghinis and buying beachfront mansions.

Unfortunately, the answer is considerably more disturbing than a bunch of cybercriminals getting rich. Some of that stolen money could potentially help finance the country’s nuclear weapons and missile programs.

The FBI has identified the attackers

In an October 31 announcement, the FBI attributed the October 29 Binance attack to North Korea, identifying the responsible operation as TraderTraitor. The announcement confirms that more than $6 billion in virtual assets was stolen from the cryptocurrency exchange.

The FBI says investigators working alongside the U.S. Secret Service and IRS Criminal Investigation have observed the attackers converting stolen assets primarily into Ethereum. Authorities expect additional attempts to launder the cryptocurrency through decentralized finance services and instant exchanges.

In other words, the money isn’t just sitting in a digital wallet waiting to be spent. Investigators are already following efforts to move it, while the attackers presumably want to make those funds harder to trace.

North Korea doesn’t need shopping malls to spend billions

It’s tempting to imagine that $6 billion would be practically useless inside North Korea. Ordinary citizens have limited purchasing power, and the government cannot freely conduct international business the way most countries can.

But that misunderstands why the money is valuable. North Korea doesn’t necessarily want to spend its stolen cryptocurrency inside its own borders.

The government needs foreign currency to purchase goods and services outside the country. Industrial machinery, electronics, specialized components, fuel, and other imports can all be valuable to a government operating under international sanctions.

Then there are North Korea’s military ambitions. Developing advanced weapons requires money, specialized equipment, technical expertise, and access to materials that might not be readily available domestically.

The U.S. Treasury Department has previously identified illicit financial networks as sources of support for North Korea’s weapons programs. American authorities have also linked North Korean cryptocurrency theft to efforts to finance nuclear weapons and ballistic missile development.

That doesn’t establish that money from this particular Binance theft has already purchased weapons. However, it helps explain why American officials treat North Korean cryptocurrency theft as something much more serious than an ordinary financial crime.

How do you spend billions when your country is sanctioned?

Here’s where things become particularly interesting. North Korea doesn’t necessarily need to convert every stolen token into cash, nor does every transaction need to take place inside the country.

The government has access to intermediaries and illicit financial networks operating internationally. These can help move money, arrange payments, and obtain goods despite restrictions intended to prevent precisely those activities.

In June 2025, the Justice Department documented one such network, describing how North Korean IT workers generated cryptocurrency revenue and worked with financial operatives to move the proceeds on behalf of the government. American authorities sought to seize more than $7.74 million connected to that scheme.

For North Korea, converting cryptocurrency into traditional currencies can make those funds easier to use for international purchases. That also explains why authorities are paying such close attention to the movement of stolen assets.

And no, sanctions don’t mean North Korea is completely unable to trade with the outside world. They restrict particular activities and relationships, but the country continues to pursue imports through permitted trade as well as networks designed to evade those restrictions.

Are the hackers themselves becoming billionaires?

Probably not, at least not in the way people might imagine. North Korea’s state-linked hacking operations aren’t comparable to independent cybercriminals stealing cryptocurrency to finance a luxurious retirement.

American officials have described a government-directed system in which illicit cyber activity generates revenue for the state. That means the people actually carrying out the attacks aren’t necessarily the ones who get to enjoy the proceeds.

Of course, that doesn’t mean individual hackers receive nothing. Their compensation and privileges aren’t publicly established in this case, and there’s no evidence that the people behind the Binance attack personally control the entire stolen fortune.

The much larger concern is what happens when stolen cryptocurrency becomes government purchasing power. Rather than funding a hacker’s collection of expensive sports cars, that money could eventually support North Korea’s military and intelligence operations.

There is a big difference between stealing and keeping $6 billion

Fortunately, stealing cryptocurrency doesn’t automatically mean the attackers will be able to spend it all. Blockchain transactions can be traced, and certain assets can be frozen before criminals manage to convert them into something more useful.

Binance reported on October 30 that approximately $3 billion in affected assets had been frozen. The FBI has also published cryptocurrency wallet addresses connected to the attackers and is urging industry participants to block transactions involving stolen funds.

According to a November 1 Reuters report, Binance announced that it had recovered or covered approximately 95 percent of the $6.3 billion in stolen assets. The exchange also began restoring cryptocurrency withdrawals in phases.

That’s reassuring for Binance customers, but it’s important not to confuse replacing stolen customer assets with recovering the stolen cryptocurrency itself. Money used to replenish customer balances doesn’t automatically take anything away from the attackers.

Likewise, freezing cryptocurrency is different from permanently recovering it. The ultimate amount recovered, and how much North Korea can successfully convert into usable funds, remains uncertain.

Even if investigators prevent the attackers from accessing a large portion of the money, the remaining amount could still be extraordinary. North Korea doesn’t need to successfully launder every dollar for this attack to become an enormous financial victory for the regime.

The real danger goes far beyond cryptocurrency

The most unsettling part of this story is that the consequences could extend well beyond Binance or the people who use cryptocurrency. Someone who has never purchased Bitcoin or opened a cryptocurrency wallet could still be affected by what North Korea does with the proceeds.

A successful digital theft can potentially provide a sanctioned government with money that would be much harder to obtain through legitimate international business. And when that government is North Korea, there are serious questions about whether the proceeds could help finance weapons development and other military activities.

The United States, Japan, and South Korea have previously warned that North Korean cryptocurrency thefts threaten the international financial system while generating revenue for prohibited weapons programs. The FBI’s confirmation of the Binance attack makes that concern particularly difficult to ignore.

This wasn’t merely another cryptocurrency platform getting hacked by criminals looking for an easy payday. According to the FBI, North Korea was responsible for stealing a sum that rivals the annual budgets of some countries.

We don’t yet know how much of the stolen cryptocurrency the attackers will ultimately manage to use. We also don’t know exactly what North Korea intends to purchase with any proceeds it successfully launders.

But the next time someone dismisses cryptocurrency theft as a problem that only affects people who invest in digital coins, it’s worth remembering this attack. The consequences could eventually reach far beyond the people who lost money.

A stolen Bitcoin might start as somebody’s financial loss, but that doesn’t necessarily mean the damage ends there. In the wrong hands, the proceeds could eventually help pay for something far more dangerous.