FBI Attributes Record $6.3 Billion Binance Crypto Theft to North Korea's TraderTraitor Group

The Federal Bureau of Investigation stated on Saturday that North Korea was responsible for the theft of more than $6 billion in virtual assets from the cryptocurrency exchange Binance on or about 29 October 2026. The agency identified the actors as the TraderTraitor group, the same unit previously linked to the $1.5 billion Bybit theft in February 2025. The FBI released the attribution jointly with the U.S. Secret Service and IRS Criminal Investigation.

Binance, the largest exchange by trading volume, reported that an attacker drained hot wallets across at least ten blockchains in approximately 20 minutes. Ethereum accounted for the largest share, roughly $3.8 billion, followed by Bitcoin at about $1.5 billion. Smaller amounts moved on Tron, XRP Ledger, Solana and other chains. Blockchain analysis firms including TRM Labs, Elliptic and Chainalysis had earlier assessed the activity as consistent with North Korean state-linked groups. Funds from the Binance theft later commingled with proceeds from a separate Bitget exploit that investigators had also tied to the same actors.

Binance suspended withdrawals after the breach. The company said an initial investigation pointed to the compromise of one engineer's laptop, which allowed unauthorised withdrawal transactions. On Saturday the exchange announced it had replaced 90 percent of the stolen amount by purchasing replacement tokens with company funds. The remaining 10 percent consists of less liquid tokens that will take longer to acquire. Binance stated it will cover the full financial impact so that users do not absorb the loss. The firm used part of its Secure Asset Fund for Users, its Futures Insurance Fund and corporate treasury holdings. Withdrawals were scheduled to resume on Sunday, and a new proof-of-reserves snapshot was planned for 2 November.

The FBI observed the hackers converting stolen assets primarily into Ethereum and expected further laundering through decentralised finance platforms and instant-swap services. The agency called on the DeFi community to block identified Bitcoin, Ethereum and Solana addresses linked to the theft. Approximately $3 billion of the stolen stablecoins and other assets were frozen on-chain through cooperation with issuers and blockchain partners. The U.S. Secret Service said its investigators were working with Circle and other private-sector partners to freeze and recover funds.

TraderTraitor is believed to operate as part of or alongside the Lazarus Group, which U.S. authorities have sanctioned since 2019. North Korea has used large-scale cryptocurrency thefts to generate foreign currency outside the formal banking system and to evade sanctions. The $6.3 billion figure exceeds all previous single-exchange crypto heists. The speed of the withdrawal, concentrated in a 20-minute window, indicates the attackers had prepared access to privileged systems in advance.

Binance has not publicly named a perpetrator. Its statements focus on user protection and the restoration of services. The FBI attribution supplies the first official government confirmation of North Korean responsibility. The combination of on-chain tracing, prior group signatures and the scale of the loss has produced a high-confidence assessment from both private analysts and U.S. law enforcement.

The incident raises questions about the security of hot-wallet operations at major exchanges and about the effectiveness of existing sanctions against North Korean cyber units. Recovery efforts continue through freezes, tracing and potential law-enforcement action. Users who held assets on Binance are expected to see their balances restored once the remaining tokens are purchased and withdrawals reopen.