FBI Attributes $6.3 Billion Binance Crypto Theft to North Korea

The Federal Bureau of Investigation attributed the theft of more than $6 billion in cryptocurrency from Binance to North Korea. The FBI released the assessment on 31 October 2026. The theft occurred on or about 29 October. The agency identified the responsible activity as TraderTraitor, the same group linked to the $1.5 billion Bybit theft in February 2025.

Blockchain analysis by TRM Labs estimated that approximately $6.36 billion moved from Binance wallets across ten blockchains. Most of the transfer happened in about 20 minutes beginning at 20:05 UTC on 29 October. A second wave followed around 23:05 UTC involving Avalanche and Polygon. The FBI observed TraderTraitor actors converting the stolen assets primarily into Ethereum. The agency expects further laundering through decentralised finance protocols and instant swap services.

The FBI, together with the U.S. Secret Service and IRS Criminal Investigation, published more than 600 Ethereum addresses, 19 Bitcoin addresses and one Solana address. It asked virtual asset service providers, node operators and analytics firms to block transactions connected to those addresses. The statement described the activity as the largest cryptocurrency theft on record.

Binance stated on 1 November that it had replaced 90 percent of the stolen amount using company funds. It set aside approximately $6.34 billion for the purpose. The remaining 10 percent consists of less liquid tokens that will take longer to acquire. The exchange said it would absorb the financial impact and that users would not bear the loss. Withdrawals resumed in phases beginning on 1 November after an earlier freeze.

TraderTraitor is tracked under multiple names including Lazarus Group, Jade Sleet and APT38. The group has been linked to numerous prior cryptocurrency thefts. The Binance incident surpasses previous records both in absolute value and in the speed of the extraction across multiple chains.

The FBI advisory contained no additional technical details on the initial intrusion method. Binance has not published a public post-mortem. The rapid conversion into Ethereum and the subsequent distribution across DeFi venues complicate recovery. Private analytics firms continue to monitor the listed addresses for further movement.

The scale of the loss prompted immediate market attention. Binance remains the largest cryptocurrency exchange by volume. Its decision to cover the shortfall from reserves avoids immediate user impact but reduces available company capital. The FBI's public listing of addresses is intended to slow the laundering process while investigations continue.

No arrests have been announced. North Korean state-linked groups have conducted similar operations for years, converting stolen digital assets into usable funds. The current case follows the same pattern of rapid extraction, conversion to a major asset and attempted dispersion through decentralised services.

Further updates will depend on whether additional assets are frozen at the listed addresses and whether Binance completes the remaining 10 percent coverage. The FBI statement remains the primary official attribution.