FBI attributes $6.3 billion Binance cryptocurrency theft to North Korean group TraderTraitor

The Federal Bureau of Investigation has attributed the theft of more than $6 billion in cryptocurrency from the Binance exchange to North Korean actors operating under the designation TraderTraitor. The attack occurred on or about 29 October 2026 and is the largest single cryptocurrency heist recorded to date.

In a public advisory, the FBI stated that TraderTraitor actors converted the stolen assets primarily into Ethereum and are expected to move them through decentralised finance protocols and instant-swap services for further laundering. The bureau, working with the U.S. Secret Service and IRS Criminal Investigation, has supplied virtual-asset service providers with addresses to monitor and block. The same group has been linked to a $1.5 billion theft from the Bybit exchange in February of the previous year.

Blockchain analysis firm TRM Labs reported that approximately $6.36 billion left Binance wallets across ten blockchains, with the bulk of the movement occurring in about 20 minutes beginning at 2005 UTC on 29 October. A second wave followed later that day on Avalanche and Polygon. Roughly $2.7 billion has been frozen on-chain by issuers including Tether, Circle, Ripple and World Liberty Financial. Arbitrum’s security council also forced certain tokens out of an attacker-controlled wallet.

Binance stated that it has covered 90 percent of the losses by using company funds to repurchase tokens. The remaining 10 percent consists of less liquid assets that will take longer to replace. The exchange said users will not bear the financial impact. Withdrawals, which had been frozen immediately after the breach, were restored on 1 November.

North Korean cyber groups have repeatedly targeted cryptocurrency exchanges and bridges to generate hard currency for the regime’s weapons programmes and to evade sanctions. Previous operations have used social-engineering of employees, malware on trading platforms and exploitation of smart-contract vulnerabilities. The speed and scale of the Binance outflow suggest either a compromise of hot-wallet infrastructure or a sophisticated social-engineering vector that granted rapid access to multiple chains.

The FBI advisory contains limited technical detail on the initial intrusion method. Investigators are examining transaction patterns, wallet clustering and any residual access that may remain. International partners have been notified. The episode has already prompted renewed calls for tighter custody standards and real-time monitoring at major exchanges.

Binance’s ability to absorb most of the loss from its own balance sheet has limited immediate customer impact, yet the incident underscores the concentration risk in centralised platforms that hold large sums of user funds. Full recovery of the remaining assets and any law-enforcement action against the operators will depend on tracing through mixers and cross-chain bridges, a process that typically stretches over months.