Regulation1 min readThe Assayer
None of 939 FBI-flagged North Korea theft addresses is on the US sanctions list
None of the 939 crypto addresses the FBI has publicly tied to North Korean thefts is on the US Treasury's OFAC sanctions list. That list held 1,056 crypto addresses on November 4, 2026, according to a Bitminer.io comparison of the two.
The 939 addresses come from four FBI notices published between January 23, 2023 and October 31, 2026. The newest notice, on the Binance theft, accounts for 627 of them. In it the FBI says North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026. The FBI calls this activity "TraderTraitor".
The other three notices cover Bybit, published February 26, 2025, with 51 addresses tied to a theft of approximately $1.5 billion. A notice of August 22, 2023 lists 6 bitcoin addresses holding about 1,580 bitcoin that North Korean actors moved "from several cryptocurrency heists". The same notice names thefts from Atomic Wallet, AlphaPo and CoinsPaid among the group's heists, without saying which of them the bitcoin came from. The notice on Harmony's Horizon bridge, first published January 23, 2023, lists 255 addresses tied to a $100 million theft.
A notice is not a sanction
Being named in an FBI notice does not put an address under sanctions. In its Binance and Bybit alerts, the FBI instead asks private companies, including exchanges, DeFi services, node operators and blockchain analytics firms, to block transactions with or derived from the listed addresses. The Binance notice describes those addresses as "operated by or closely connected to North Korean TraderTraitor actors".
OFAC does list 131 crypto addresses under its North Korea sanctions programmes. Eight of them are listed under Lazarus Group itself. None of the 131 appears among the FBI's 939.
In the Binance notice the FBI says it has seen the stolen assets converted primarily into ether. It expects them to be laundered further through DeFi and instant swap services.
Bitminer.io's address check screens addresses against both the OFAC list and the FBI's published theft addresses.
Sources
- FBI: North Korea Responsible for $6 Billion+ Binance Attack (October 31, 2026)
- FBI: North Korea Responsible for $1.5 Billion Bybit Hack (February 26, 2025)
- FBI: FBI Identifies Cryptocurrency Funds Stolen by DPRK (August 22, 2023)
- FBI: FBI Confirms Lazarus Group Cyber Actors Responsible for Harmony's Horizon Bridge Currency Theft (January 23, 2023)
- Bitminer.io comparison of the OFAC SDN list (sdn.csv) with the FBI notices
- Bitminer.io address check
By The Assayer, the Bitminer.io house byline. Written by AI from the sources above and checked automatically. No person reviewed it before publication. How we work.
Every crypto theft the US attributes to North Korea
More on North Korea
