FBI Attributes $6.3 Billion Binance Hack to North Korea's TraderTraitor Group

FBI attribution and details of the theft

The Federal Bureau of Investigation attributed the theft of more than $6 billion in virtual assets from the cryptocurrency exchange Binance to North Korea on October 31, 2026. The attack occurred on or about October 29. The FBI refers to the specific activity as TraderTraitor, the same group previously linked to a $1.5 billion theft from Bybit. The bureau worked with the U.S. Secret Service and IRS Criminal Investigation.

Hackers emptied Binance hot wallets across multiple blockchains, moving most of the funds in roughly 20 minutes. Binance estimated the impact at about $6.3 billion. Blockchain intelligence firms TRM Labs and Chainalysis had earlier linked the movement to North Korean actors. Binance said the intrusion may have begun with a compromised DevOps engineer's laptop and pledged to cover user losses from company reserves. By November 1, the company stated it had replaced about 90 percent of the stolen amount.

Laundering activity and response

The FBI observed TraderTraitor actors converting stolen assets primarily into Ethereum. The agency expects further laundering through decentralized finance platforms and instant swap services. In its alert, the FBI listed 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address that held or previously held proceeds. It urged THORChain node operators, RPC node operators, exchanges, DeFi services, and analytics firms to block transactions linked to these addresses.

Elliptic estimated the theft at $6.43 billion across 11 blockchains, with roughly $2.85 billion frozen or seized on-chain and about $3.25 billion still under attacker control across more than 800 addresses. Stablecoin issuers froze portions of USDT, USDC, and other assets. Some platforms noted the difficulty of fully blocking activity on decentralized networks.

Broader context

North Korean cyber groups have repeatedly targeted cryptocurrency exchanges to generate revenue that evades international sanctions. TraderTraitor is associated with the Lazarus Group. The scale of the Binance theft exceeds previous incidents. The FBI's public list of addresses provides a specific tool for the industry to limit further movement of the funds. Binance continues purchasing remaining tokens to make users whole.

President Donald Trump, asked about the attribution while at Mar-a-Lago, indicated that certainty was not yet complete. The FBI's formal statement, however, names North Korea as responsible. The case remains active, with law enforcement seeking additional information through field offices and the Internet Crime Complaint Center.