On the evening of Oct. 29, an attacker drained Binance hot wallets across 11 blockchains, most of them within about 30 minutes. Elliptic puts the haul at $6.43 billion—more than four times the Bybit heist and almost certainly the largest theft of any kind in history, more than six times the $1 billion Saddam Hussein took from Iraq’s central bank on the eve of the 2003 war.
Elliptic quickly attributed the Binance theft to North Korea, citing methods consistent with TraderTraitor, a state hacking group associated with the Lazarus Group, and stolen funds that reached the same address as proceeds of a suspected North Korean exploit of Bitget. Chainalysis has reached the same conclusion. On the same day as the heist, North Korea also fired about 10 ballistic missiles into the Sea of Japan.
On Oct. 31, the FBI confirmed those early private-sector assessments and declared that North Korea was responsible for the Binance theft, though details of the attack and the disposition of the stolen funds are still developing But the pattern is unmistakable, and it is one I have warned about for years in ICBA’s comment letters: North Korea steals crypto, launders it through the gaps in our regulatory framework, and turns the proceeds into weapons.
This is not just a cybercrime story. It is a national security emergency founded on the gaps in regulation and oversight of digital assets. And it’s a key reason why policymakers must close these gaps through strong and meaningful crypto restrictions.
Crypto’s most dangerous actor is a nuclear power
North Korea is not one threat actor among many. It is the threat actor.
Chainalysis found that North Korean hackers stole $2.02 billion in 2025—about 60% of all crypto stolen worldwide and a record 76% of all hacks of crypto services—bringing their all-time total to $6.75 billion. Elliptic had tracked more than $1 billion in North Korean thefts in 2026 before Binance was hit, and it estimates that this single heist would almost double everything the regime has stolen in crypto to date.
And the money does not stay in the dark corners of the internet. The Financial Action Task Force (FATF) has identified North Korea as the world’s most significant proliferation financing threat, finding that its cyberattacks on virtual asset firms have generated billions to help finance its weapons of mass destruction program.
The 11-nation Multilateral Sanctions Monitoring Team—including the United States, South Korea, and Japan—found that North Korea stole roughly $2.84 billion in crypto between January 2024 and September 2025 and that its cyber operations fund its unlawful weapons of mass destruction and ballistic missile programs.
Other reports noted that crypto theft supplied roughly one-third of the regime’s foreign currency revenue in 2024. Stolen crypto is a line item in Pyongyang’s weapons budget.
The threat posed by regulatory inaction
Those weapons are real. North Korea has conducted multiple nuclear tests, has written its nuclear status into its constitution, and now calls that status “irreversible.” SIPRI estimates it has assembled about 60 nuclear warheads, with fissile material for up to 90. In April 2026, a U.S. defense official testified that North Korea’s nuclear forces are “increasingly capable of targeting the U.S. Homeland” and that its missiles “can strike South Korea and Japan with nuclear or conventional warheads.”
For our allies and the Americans who serve alongside them, the threat is immediate. About 28,500 U.S. service members are stationed in South Korea, and roughly 60,000 serve in Japan, the largest U.S. military presence overseas. All are within range of North Korea’s missiles. The Oct. 29 salvo—the latest of several so far this year—came a day after the United States and its partners announced sanctions targeting its cyber activities, among other conduct. One Korean analyst said it showed the regime “has the capability to completely destroy major South Korean and US military facilities.”
Japan’s own markets have also been hit: DMM Bitcoin was among the exchanges breached by North Korean hackers. And in July 2026, the United States, Japan, South Korea, and other partners jointly warned that North Korean IT worker networks steal crypto and fund the regime’s nuclear weapons and ballistic missile programs.
The conclusion is inescapable: regulatory inaction is not a neutral choice. Every gap that lets stolen crypto move faster than the law is a potential funding channel for a nuclear-armed regime that threatens the United States and its closest allies.
The weaknesses are built in, not bolted on
Crypto advocates treat hacks as isolated failures of individual firms. They are not. The features the industry markets as strengths—speed, irreversibility, borderless transfers, pseudonymity, and permissionless access—are exactly what a state-sponsored thief needs.
When billions can leave an exchange across 11 blockchains in about half an hour, the system is not merely vulnerable to bad actors. Once they get in, it is optimized for them.
Composability makes it worse. Protocols plug into one another by design, so stolen funds can hop from an exchange to a bridge, a decentralized exchange, a lending protocol, and a mixer without touching a single entity clearly responsible for stopping them. Each piece claims to be mere infrastructure. Together, they form a financial system with no reliable way to reverse fraud and no consistent accountability for the gaps between its parts.
The regulatory response must be comprehensive
Exchange security, crypto mixers, decentralized finance (DeFi), stablecoins, and anti-money laundering (AML) rules are not separate debates. They are links in a single chain, and North Korea needs to find only the weakest one.
Yet Washington keeps treating them one link at a time—writing stablecoin rules under the GENIUS Act while abandoning its mixer proposal and leaving much of DeFi outside the AML perimeter—even as parts of the crypto industry lobby for carve-outs that would loosen the rest. That is not a security framework. It is a map, and Pyongyang reads it better than anyone.
Given the weaknesses in crypto security and the very real consequences for U.S. national security, Washington must prioritize stringent regulatory standards for the digital assets sector. The nation’s security depends on it.
Brian Laverdure is ICBA senior vice president of digital assets and innovation policy.