FBI Attributes $6.3 Billion Binance Theft to North Korean TraderTraitor Group

The FBI stated on 31 October 2026 that North Korean actors operating under the designation TraderTraitor carried out the theft of more than $6.3 billion in cryptocurrency from Binance on 29 October. The attack emptied hot wallets on multiple blockchains within roughly 20 minutes. Binance estimates the total at approximately $6.3 billion; blockchain analytics firm Elliptic places the figure at $6.43 billion across 11 chains.

Most of the funds left Binance wallets starting around 16:00 US Eastern time on 29 October. Binance initially indicated that the intrusion may have begun with a compromised DevOps engineer's laptop. The company froze withdrawals, pledged to cover all customer losses, and began a phased resumption of withdrawals on 1 November. It reported freezing roughly $3 billion of the stolen assets.

TraderTraitor is the same designation the FBI applied to the group responsible for the approximately $1.5 billion theft from Bybit in February 2025. Blockchain firms TRM Labs and Chainalysis linked the Binance incident to the group within hours of the theft. The FBI, US Secret Service, and IRS Criminal Investigation jointly issued the attribution and published a list of addresses used by the actors.

The agencies observed the attackers converting stolen assets primarily into Ethereum. They expect further laundering through decentralized finance protocols and instant swap services. Elliptic reports that the attacker still controls about $3.25 billion in assets that cannot be frozen by issuers, spread across more than 800 addresses. Roughly $2.85 billion has been confirmed frozen or seized on-chain.

North Korean state-linked groups have conducted a series of large exchange and bridge thefts since at least 2017. The Binance haul is more than four times the size of the Bybit incident and ranks as the largest single cryptocurrency theft on record by the figures currently available from the analytics firms. The speed of the withdrawal—most funds moved in 20 minutes—limited the window for on-chain freezes during the active phase.

Binance co-founder Changpeng Zhao publicly thanked the Secret Service and other agencies for assistance in tracking and freezing funds. The exchange has not published a full technical post-mortem. The FBI's public alert focuses on the attribution and the request that exchanges, DeFi platforms, and other operators block transactions involving the listed addresses.

The practical effect for the remaining unfrozen funds is ongoing movement. Analytics firms have tracked thousands of automated transactions as the actors swap assets and disperse them. Because a substantial portion sits in assets that no central issuer can freeze, recovery depends on cooperation from exchanges that receive the funds and on law-enforcement seizures in jurisdictions that control those platforms.

For North Korea, the cumulative total of cryptocurrency thefts attributed to its groups now exceeds $6 billion from this single incident alone, on top of prior hauls. Those funds have historically been used for procurement of sanctioned goods and for regime revenue. The scale of the Binance theft raises the absolute amount available for such uses if the remaining $3.25 billion is successfully cashed out.

The incident also highlights the concentration risk on large centralized exchanges. A single compromised credential or internal access point produced a multi-billion-dollar outflow. Binance's response—immediate freeze of withdrawals, customer reimbursement pledge, and cooperation with US agencies—limited customer impact but did not prevent the initial extraction.

Investigators have not released details of the exact initial access method beyond the earlier mention of a DevOps laptop. Attribution rests on the FBI's statement, the matching of on-chain patterns to prior TraderTraitor activity, and the rapid consensus among multiple analytics firms. No public denial has come from North Korean official channels.

The open question for the industry is how much of the remaining unfrozen portion can be blocked before it reaches cash-out points. The FBI's list of addresses and the joint agency request to block related transactions constitute the primary public tools available so far.