FBI Attributes Record $6.3 Billion Binance Crypto Theft to North Korea

The Federal Bureau of Investigation attributed the theft of more than $6 billion in virtual assets from the cryptocurrency exchange Binance to North Korea. The FBI statement, issued on 31 October 2026, said the Democratic People’s Republic of Korea was responsible for the theft on or about 29 October and labelled the activity TraderTraitor.

The FBI, working with the U.S. Secret Service and IRS Criminal Investigation, observed TraderTraitor actors converting the stolen assets primarily into Ethereum. The bureau expects further laundering through decentralised finance platforms and instant swap services. It published lists of wallet addresses and urged virtual-asset service providers to block related transactions.

Blockchain analytics firms had already linked the outflow to the same group. TRM Labs estimated roughly $6.36 billion moved from Binance wallets across ten blockchains, most of it in about 20 minutes. The figure exceeds the previous record set by the $1.5 billion Bybit theft attributed to the same actors in February 2025. Elliptic placed the haul at about $6.43 billion and noted that the single incident nearly doubles the total crypto assets previously attributed to the regime.

Binance said it has replaced approximately 90 percent of the stolen amount using company funds and is continuing to purchase the remaining less-liquid tokens so that users are fully covered. The exchange reopened customer withdrawals after an initial freeze. Major assets including Bitcoin, Ethereum, Tether and BNB were reported as fully backed. The company stated that it would absorb the financial impact rather than pass losses to users.

President Donald Trump, asked about the attribution while at Mar-a-Lago, suggested investigators were not yet certain of North Korean involvement and described the situation as a continuing cat-and-mouse game. The FBI statement did not include detailed technical evidence beyond the attribution and the observed conversion pattern.

The theft is the largest single cryptocurrency heist on public record. North Korean state-linked groups have conducted a series of exchange and bridge attacks in recent years, converting proceeds into harder-to-trace assets and using them to fund state programmes. The current laundering phase, concentrated on Ethereum and DeFi, matches patterns documented in earlier FBI advisories on TraderTraitor.

Exchanges, analytics firms and infrastructure operators have been asked to monitor and freeze the listed addresses. Recovery of the funds remains unlikely once they have moved through multiple mixing and swap stages. Binance’s decision to cover the loss from reserves protects customers in the short term while shifting the cost onto the company’s own balance sheet.