North Korea is blamed for a $6.3bn crypto theft. The US rarely strikes back fast.

What happened

The world’s largest cryptocurrency exchange has been hit by an industry-record $6.3bn (£4.7bn) hack, with experts identifying North Korea as the likely culprit.

Hackers took about $6.3bn from Binance on 29 October. Binance is the world’s biggest crypto exchange, with 335 million registered users. It stopped all deposits and withdrawals and said about $3bn had been frozen so far. Its co-chief executive, Richard Teng, said “your money is safe, and we’re covering every loss”.

Two crypto analysis firms blamed North Korea. TRM said with “high confidence” that the theft was the work of TraderTraitor, an elite North Korean hacking unit, and Chainalysis agreed. The security firm Check Point said the same unit is also known as Lazarus Group. North Korea has denied any part in hacks before. In 2025 the same unit took about $1.5bn from Bybit, an exchange in Dubai.

The US government has not named anyone yet. On 30 October Reuters reported that the FBI and the US Secret Service are working with Binance. But the FBI has published no notice about the theft, and neither the US Treasury nor the Justice Department has acted over it. On 28 October the Treasury put 10 people and one company on its sanctions list for helping North Korean IT workers cheat US businesses, but that action did not mention Binance.

Two US tools could follow. The Treasury’s Office of Foreign Assets Control (OFAC) can add people, firms or crypto wallets to its sanctions list, which bars Americans from dealing with them. The Justice Department can go to court to take stolen money for good, known as civil forfeiture. By the end of 2025 it had seized about $72.6m stolen by North Korean hackers. The stablecoin firms Tether and Circle, which issue coins tied to the dollar, have frozen nearly $1.57bn and more than $800m linked to the theft.

Treasury will continue to use all available tools to protect U.S. businesses from these malicious activities and hold those responsible accountable.

Scott Bessent, US Treasury Secretary, on North Korean IT workers, 28 October 2026

Sources: The Guardian (2), BBC, BBC, FBI, US Treasury, US Justice Department, US Justice Department

The Pattern

We looked for cases where hackers linked to North Korea stole $100m or more in crypto from a company that kept the money. Then we checked whether the US Treasury sanctioned someone it tied to that theft, or US prosecutors went to court to take its money, and how fast. We found eight such thefts since 2018. The US dealt with the three from 2023 in one action.

The Read

Today is day one, and the end of the year is day 63. Both times the US moved inside that line were in 2022, 44 and 46 days after the theft, and each time it sanctioned a coin-mixing service that hid part of the money. In March 2025 the Treasury lifted its sanctions on one of them, Tornado Cash. The other two US actions came after about two years, and both included going to court to take the money. About $2.3bn of the Binance money is frozen by two stablecoin firms, Tether and Circle, the kind of money prosecutors have taken to court before.

There are reasons for doubt. The closest example is Bybit: the same unit, named by the FBI in five days, and still no US sanctions or court action over it 616 days later. Each time the same two US bodies decided, the Treasury and the Justice Department. For four of the eight thefts, the US papers do not name the firm that was robbed, so they are known mainly through the US action itself. Bybit is also only 616 days old, while the slow US actions came after 672 to 867 days, so a late move on it is still possible.