FBI Attributes $6.3 Billion Binance Crypto Theft to North Korean Hackers

The Federal Bureau of Investigation attributed the theft of more than $6 billion in cryptocurrency from Binance to North Korea’s TraderTraitor hacking operation. The attack occurred on or about October 29, 2026, and drained funds from hot wallets across multiple blockchains in roughly 20 minutes.

Binance, the largest cryptocurrency exchange by trading volume, estimated the loss at $6.3 billion. Blockchain analysis firms Elliptic and TRM Labs calculated $6.36 billion to $6.43 billion across 10 to 11 chains. The scale exceeds the previous record of $1.5 billion stolen from Bybit in February 2025, also linked to the same North Korean group.

Binance said the intrusion began with a compromised engineer’s laptop that allowed access to privileged systems. Partners including Circle and Tether froze roughly $971 million and $825 million in stablecoins respectively. Overall, about $2.85 billion to $3 billion of the stolen assets were frozen on-chain. Binance pledged to cover all customer losses from company funds and its Secure Asset Fund for Users. Withdrawals resumed in phases starting November 1.

As of early November, approximately $3.24 billion remained in addresses linked to the theft, mostly in Ethereum and Bitcoin. Analysts expect the remaining funds to be swapped and moved through over-the-counter brokers and exchanges, following patterns seen in the Bybit case. Chinese money-laundering networks have previously handled North Korean proceeds.

The FBI stated that the hackers have been converting assets into Ethereum in preparation for further laundering. TraderTraitor is the FBI’s designation for the group behind multiple large exchange thefts. The attack involved more than 12,000 wallets and 40,000 transactions in the first four days according to Elliptic tracking.

The incident highlights the concentration of customer assets in exchange hot wallets and the speed with which state-linked actors can extract them once internal access is obtained. Binance’s decision to reimburse users shifted the immediate financial impact to the company while law enforcement and blockchain monitors continue tracing the unfrozen portion.

North Korean cyber operations have generated substantial foreign currency for the regime through repeated large-scale thefts. The $6.3 billion haul represents a significant increase in scale over prior incidents and will test the ability of exchanges and stablecoin issuers to freeze assets in real time.