FBI Attributes Record $6.3 Billion Binance Crypto Theft to North Korean Hackers

The Federal Bureau of Investigation announced on 31 October 2026 that North Korea was responsible for the theft of more than $6 billion in virtual assets from the cryptocurrency exchange Binance on or about 29 October. The FBI designated the activity as TraderTraitor, the same designation used for earlier North Korean operations including a $1.5 billion theft from Bybit in February 2025.

Binance said the attackers emptied hot wallets across multiple blockchains, with the bulk of the funds moved within about 20 minutes. The exchange estimated the loss at roughly $6.3 billion, the largest publicly reported crypto theft to date. Binance stated it would cover user losses from company reserves and later reported that it had replaced about 90 percent of the stolen amount. Approximately $3 billion of the funds were frozen or seized on-chain with assistance from issuers such as Tether and Circle.

The FBI, working with the U.S. Secret Service and IRS Criminal Investigation, observed TraderTraitor actors converting stolen assets primarily into Ethereum and preparing them for further laundering through decentralized-finance protocols and instant-swap services. The bureau published lists of Ethereum, Bitcoin and Solana addresses linked to the theft and called on node operators, exchanges and analytics firms to block transactions involving those addresses.

Blockchain analysis firms TRM Labs and Chainalysis had earlier attributed the attack to TraderTraitor on the basis of on-chain patterns. North Korea has previously been linked to large-scale cryptocurrency thefts that U.S. officials say help fund weapons programs. The FBI noted that North Korean actors also use other methods, including remote IT employment, to generate revenue.

Binance initially indicated that the intrusion may have begun with a compromised DevOps engineer’s laptop. The company paused withdrawals briefly after the incident and later resumed them. Industry partners assisted in tracking and freezing assets in the hours immediately after the theft.

The scale of the loss exceeds previous major exchange hacks. Elliptic and other firms estimated that several billion dollars remain under attacker control in forms that cannot be frozen by issuers. Laundering activity has continued across multiple chains, with automated swapping observed in the days following the theft.

U.S. authorities have urged virtual-asset service providers to monitor the published addresses closely. No arrests have been announced. The attribution reinforces ongoing concerns about state-sponsored cyber activity targeting cryptocurrency platforms as a sanctions-evasion tool.