FBI attributes $6.3 billion Binance theft to North Korea’s TraderTraitor group

The FBI stated on October 31 that North Korea was responsible for the theft of more than $6 billion in virtual assets from the cryptocurrency exchange Binance on or about October 29. The bureau, working with the U.S. Secret Service and IRS Criminal Investigation, identified the activity as that of the group it tracks as TraderTraitor, the same actors previously linked to the $1.5 billion Bybit theft in February 2025.

Binance estimated the loss at roughly $6.3 billion. Blockchain analysis firms TRM Labs and Chainalysis attributed the attack to TraderTraitor within a day. TRM reported that approximately $6.36 billion moved out of Binance wallets on ten blockchains, most of it in about 20 minutes starting around 20:05 UTC. A second wave followed later that evening on Avalanche and Polygon. Elliptic put the total near $6.43 billion across 11 chains.

Binance said its initial review pointed to the compromise of one DevOps engineer’s laptop and vulnerabilities in the transaction approval system. The exchange suspended withdrawals, then reopened them after restoring backing for the majority of affected assets with company funds. It stated that users would not bear the loss and that it had covered roughly 90-95 percent of the stolen amount, with the remainder consisting of less liquid tokens still being replaced.

The FBI observed the actors converting stolen assets primarily into Ethereum and expected further laundering through decentralized finance platforms and instant-swap services. It released lists of hundreds of Ethereum, Bitcoin and Solana addresses associated with the movement and urged virtual asset service providers to block transactions linked to those addresses. By early November, analysts estimated that roughly $2.7-2.85 billion had been frozen or seized on-chain by issuers including Tether, Circle, Ripple and others, while the attackers still controlled several billion in unfreezable assets across more than 800 addresses.

North Korean state-linked groups have stolen an estimated $12.8 billion in cryptocurrency since 2017, according to TRM’s cumulative figures. The funds are widely assessed as supporting the regime’s weapons programs and sanctions evasion. Binance co-founder Changpeng Zhao publicly thanked law enforcement and industry partners for rapid tracking and freezing efforts.

The speed of the extraction—most of the value moved in roughly 20 minutes—highlights the operational tempo of the actors. The combination of a compromised endpoint and approval-process weaknesses allowed the simultaneous draining of hot wallets across multiple chains. Recovery efforts continue through freezes, seizures and ongoing laundering disruption. The scale exceeds prior single-exchange thefts and adds to the cumulative pressure on centralized platforms’ security architectures.