Following stolen cryptocurrency from the Binance Heist to historical lessons.
Sources
Chainalysis — Binance hack: tracing the $6.4 billion theft to North Korea (30 Oct 2026)PBS NewsHour / AP — FBI says North Korea was behind $6.3 billion Binance heistBleepingComputer — Binance links $6.3 billion crypto theft to compromised DevOps laptopWikipedia — 2026 Binance hack (timeline compiled from CNBC, BBC, The Guardian)Wikipedia — 2026 Binance hack, citing The Guardian's interview with Elliptic's chief scientist ("almost certainly the single largest-known theft of any kind")Engadget — Mt. Gox CEO Mark Karpelès cleared of embezzlement (2019)Cointelegraph — Japanese court finds ex-Mt. Gox CEO guilty of record tamperingCointelegraph — Mt. Gox begins repayments in bitcoin and bitcoin cash (July 2024)TRM Labs — Ilya Lichtenstein sentenced for role in Bitfinex hackThe Block — Bitfinex hacker sentenced to five yearsThe Block — The DAO hack, ten years onFortune — Coincheck NEM hack (2018)CNN Money — Kaspersky: hackers stole up to $1 billion from banks (2015)Help Net Security — Carbanak / Cobalt gang leader arrested (Europol, 2018)Wikipedia — Bangladesh Bank robberyUS Department of Justice — North Korean regime-backed programmer charged (2018)Mandiant / Google Cloud — APT38: details on a new North Korean regime-backed threat groupCointelegraph — Poly Network hacker returns nearly all fundsEngadget — Poly Network: funds returned except $33M frozen by TetherThe Register — Wormhole theft (2022)Malwarebytes — Fake job offer leads to $600 million theft (Ronin)The Block — How a fake job offer took down the world's most popular crypto gameBleepingComputer — FBI links largest crypto hack ever to North Korean hackers (Ronin)Harmony — Horizon bridge hack statementThe Record — FBI: North Korean hacking group Lazarus behind $100 million Harmony heistBleepingComputer — FBI links North Korean hackers to $308 million crypto heist (DMM Bitcoin, 24 Dec 2024)CoinDesk — WazirX sees $230M in suspicious withdrawalsTechCrunch — Bybit says it was hacked and lost around $1.4 billionBleepingComputer — Lazarus hacked Bybit via a breached Safe{Wallet} developer machineFBI / IC3 — PSA I-022625-PSA: North Korea responsible for $1.5 billion Bybit hackThe Record — Drift confirms $280 million stolenThe Block — KelpDAO $293 million hack, LayerZero blames LazarusCoinDesk — UN report: North Korean hackers stole $3B since 2017NK News — Cybercrime funds half of North Korea's missile program, US official saysAl Jazeera — Russia blocks renewal of UN panel monitoring North Korea sanctionsWorldECR — North Korea stole $2.84B in crypto over 21 months, monitoring team reportsSecurity Boulevard — North Korean hackers stole $1.34 billion in crypto in 2024 (Chainalysis)Fortune — North Korea stole a record amount of crypto in 2025CISA / FBI / Treasury — AA22-108A: TraderTraitorUS Treasury — Sinbad.io sanctioned (mentions Blender.io, May 2022)US Treasury — Tornado Cash sanctioned (Aug 2022)Jones Day — Fifth Circuit reverses Tornado Cash sanctions rulingSecurity Affairs — US Treasury removed sanctions on Tornado CashAxios — Tornado Cash developer Alexey Pertsev sentencedDecrypt — Jury finds Tornado Cash developer Roman Storm guilty of money transmitting chargeThe Defiant — Lazarus launders Bybit ETH via THORChainElliptic — Bybit exploit six months on: novel laundering tactics (citing zeroShadow)Cointelegraph — OFAC sanctions OTC traders who converted crypto for Lazarus (2023)Cointelegraph — Bybit can trace funds through a US court; its June 2026 filing: 90.2% untraceable (8 Aug 2026)Decrypt — North Korean hackers pocket over $100M in Atomic Wallet heist (Elliptic)CoinDesk — Atomic Wallet hackers move stolen funds via OFAC-sanctioned exchange GarantexFBI / IC3 — PSA I-012325-PSA: North Korean IT workers conducting data extortionThe Record — BTC-e operator Alexander Vinnik pleads guilty to money launderingBleepingComputer — US indicts North Korean hackers for stealing $1.3 billion (2021; United States v. Jon Chang Hyok et al., C.D. Cal. 2:20-cr-00614)FBI — Cyber's Most Wanted: Park Jin Hyok (also Jon Chang Hyok, Kim Il)TechCrunch — US Treasury sanctions North Korean hackers over Sony hack and WannaCry attack (2018)Australian Minister for Foreign Affairs Penny Wong — Sanctions on cyber criminals funding North Korean weapons of mass destruction (6 Nov 2025)US Treasury — Treasury sanctions individuals laundering cryptocurrency for Lazarus Group (Mar 2020)Folio Defence — our own lookups, 1-2 November 2026: the delegation transaction and the operator's funding on Blockscout; the 19 FBI-listed Bitcoin addresses on mempool.space (none spent); the Tron wallets and Tether's blacklist on TronGrid; the XRP receiver on the XRP Ledger (sent out on 2 November); 0x1510's THORChain-router inflows and its payments to five FBI-listed addresses; Chainflip deposits checked for nine of the theft's role wallets (none found, some Bitcoin transactions unreadable); THORChain: three wallets read with no swaps, then the public index refused further lookups for 24 hours; US federal court records (CourtListener) screened for namesakes.TRM Labs — North Korea steals $6.36 billion from Binance in the largest hack in history (29 Oct 2026; data as of 30 Oct, 00:30 UTC)Elliptic — The largest theft in history: North Korea behind the $6.4 billion Binance hack (updated 1 Nov 2026)CryptoSlate — ZachXBT and MistTrack findings (30 Oct 2026)Elliptic — The Binance hack is laundering on autopilot (31 Oct 2026)The Block — LayerZero apologises for its Kelp DAO response, admits fault in its single-verifier setupMusic and sound
Music and sound effects: Folio Defence originals, Epidemic Sounds.
https://www.foliodefence.com/podcast/six-billion-in-twenty-minutes/