FBI Attributes Record $6.3 Billion Binance Crypto Theft to North Korea

The Federal Bureau of Investigation said on 1 November 2026 that North Korea was responsible for the theft of more than $6 billion in virtual assets from the cryptocurrency exchange Binance on or about 29 October. The agency identified the activity as TraderTraitor, the same group previously linked to a $1.5 billion theft from Bybit. The FBI, working with the U.S. Secret Service and IRS Criminal Investigation, observed the actors converting stolen funds primarily into Ethereum and preparing further laundering through decentralised finance and instant-swap services.

Binance, the largest exchange by trading volume, reported the loss at approximately $6.3 billion across ten blockchains, with the bulk moved in roughly 20 minutes. The company said it had covered about 90 percent of the shortfall using its own reserves and would continue purchasing remaining less-liquid tokens until users were made whole. Withdrawals resumed after a temporary freeze. Net outflows on the day after the announcement reached several billion dollars, equal to a low single-digit percentage of assets under management.

Blockchain analytics firms TRM Labs and Chainalysis had earlier attributed the movement to TraderTraitor on the basis of wallet patterns and timing. The FBI published hundreds of Ethereum addresses, along with Bitcoin and Solana addresses, and urged exchanges, node operators and analytics providers to block related transactions. The bureau noted that the single incident nearly doubles the cumulative value of cryptocurrency previously attributed to the regime.

North Korean state-linked groups have conducted repeated large-scale digital-asset thefts to generate hard currency. TraderTraitor has been tracked under multiple names including Lazarus Group and APT38. The October operation appears to have begun from a compromised DevOps engineer's laptop, allowing unauthorised withdrawal transactions. The speed and scale exceed prior incidents.

Exchanges face renewed pressure to strengthen endpoint security and multi-signature controls. The FBI has asked anyone with information to contact a field office or the Internet Crime Complaint Center. Laundering through decentralised protocols will complicate recovery, though published address lists give compliance teams concrete indicators to act on. Binance's decision to absorb the loss from corporate funds limits direct customer impact but raises questions about reserve adequacy after a multi-billion-dollar hit.