North Korea Bitcoin: FBI Says 18,270 BTC Still Has Not Moved

The FBI now says North Korea took the money. On October 31 it named the North Korean group TraderTraitor for the theft of more than $6 billion from Binance. Part of that haul is North Korea bitcoin: about 18,270 BTC, worth about $1.4 billion at $77,696. As of Sunday, it had not moved. Here is what the FBI said, where the money is going, and what it means for miners.

What the FBI actually said

The alert came from the FBI, the U.S. Secret Service and IRS Criminal Investigation. It says North Korean actors took more than $6 billion in virtual assets from Binance on or about October 29. Binance’s own estimate is about $6.3 billion. Both CoinDesk and Hackread report the same list: 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address.

The FBI asks exchanges, DeFi services, bridges and node operators to block any transaction tied to those addresses. It also says the thieves are converting the loot “primarily into Ethereum.” However, the alert does not show its evidence. Chainalysis, Elliptic and TRM Labs had already linked the theft to North Korea from on-chain ties to past hacks.

Who is behind the North Korea bitcoin theft

TraderTraitor is a North Korean state-backed group. A 2022 U.S. government advisory says it has been active since at least 2020. Security firms also track it as Lazarus Group, APT38 or BlueNoroff, per The Block. The FBI also blamed the same group for the $1.5 billion Bybit hack in February 2025, as NBC News reported then. So Binance alone is about 4 times the size of the previous record.

Where the money is going

The laundering started fast. Onchain analyst SomaXBT told The Block that about $242 million moved out through Tron in two days. Most of it went through swap services such as Relay, THORChain and Chainflip. Meanwhile, Lookonchain flagged the one listed Solana wallet swapping SOL for bitcoin on Sunday. In addition, Elliptic says the main Tron wallet paid out every hour for 31 straight hours. Its co-founder calls that “operators making decisions, with scripts doing the repetitive work.”

Stablecoins are the weak spot for the thieves. Issuers have frozen more than $2.4 billion, CoinDesk reports. Bitcoin is different. Nobody can freeze a bitcoin address.

The North Korea bitcoin that has not moved

The 19 bitcoin addresses held about 18,270 BTC on November 1. The Block checked this on mempool.space, and Bitcoin.com News reports the same coins as untouched. Elliptic counts slightly more, about 18,327 BTC, so treat the number as a range.

For scale, miners make about 452 new BTC a day right now, per mempool.space. So the hackers hold about 40 days of new supply. If it hit the market quickly, that is over a month of miner output landing at once. That is the risk to price, and price is what miners live on.

What it means for miners and exchanges

First, we doubt a fast dump. Selling 18,000 BTC on open markets means going through exchanges that now have the addresses. After Bybit, the group moved much of the stolen ether through THORChain swaps instead, per The Block. Still, any large move from those 19 addresses will hit headlines and the price within minutes.

Second, the hashprice math. At $77,696 and about 1,068 EH/s, a 10% price drop cuts about $3.29 per PH/s per day from revenue. On older machines that can be the whole margin. For that reason, we check break-even before we buy, not after. Our mining economics guides show the arithmetic.

Third, exchanges. Every service on the FBI list now has to screen these addresses. Even so, Relay moved about $38 million in seven hours despite its screening, analyst Specter told The Block. So for miners, the lesson is the same as last week: pay out to your own wallet. Our report on the Binance hack covers that step, and the Binance Pool shutdown guide covers moving pools.

What we think

The attribution matters less than the North Korea bitcoin itself.The FBI named a group the industry had already named. In contrast, the 18,270 BTC sitting still is the live risk. We would watch those addresses, not the press releases. If you want machines that still pay at lower prices, see our miners in stock or the daily view on our Bitcoin price prediction page.

-Nick
ING Mining

This is general information, not financial advice. Crypto is volatile, and you can lose money. Please do your own research.