FBI Attributes Record $6.3 Billion Binance Crypto Theft to North Korean Hackers

The Federal Bureau of Investigation attributed the theft of more than $6.3 billion in cryptocurrency from the Binance exchange to North Korean state-sponsored hackers on 31 October 2026. The attack occurred on or about 29 October. The FBI, working with the U.S. Secret Service and IRS Criminal Investigation, identified the responsible actors as the group known as TraderTraitor, previously linked to the $1.5 billion Bybit theft in February 2025.

Binance stated that the intrusion began with a compromised DevOps engineer’s laptop. That access allowed the attackers to reach a service container and authorize unauthorized withdrawals. Most of the funds left Binance hot wallets across multiple blockchains within roughly 20 minutes. Blockchain analytics firms TRM Labs and Elliptic independently linked the flows to TraderTraitor within hours of the theft. Elliptic estimated the total at about $6.43 billion across 11 blockchains and confirmed that roughly $2.85 billion had been frozen or seized on-chain by early November. The remaining balance, around $3.25 billion, sat in addresses the issuer cannot freeze.

The FBI observed the attackers converting stolen assets primarily into Ethereum and expected further laundering through decentralized finance platforms and instant-swap services. The bureau published a list of hundreds of addresses associated with the theft and asked exchanges, DeFi protocols and other virtual asset service providers to block transactions involving those addresses. Binance co-founder Changpeng Zhao thanked the agencies and industry partners for rapid freezes and said the company would continue until users are made whole. Binance has already replaced the majority of the stolen tokens with company funds and pledged to absorb the remaining impact.

North Korean cyber groups have stolen an estimated $12.8 billion in cryptocurrency since 2017 according to TRM Labs figures cited in coverage of the incident. The revenue supports the regime’s weapons programs and sanctions evasion. The speed of the Binance withdrawal—most funds moved in 20 minutes—demonstrates the operational tempo these groups have achieved. Automated transaction patterns appeared in the subsequent laundering activity.

Binance suspended withdrawals briefly while it assessed the breach and began restoration. Deposits remained available. The company later said 90 percent of the affected balances had been restored and that the remaining less-liquid tokens would be purchased over time. Customer accounts were not charged for the loss. The incident is the largest publicly reported cryptocurrency exchange theft to date.

The FBI alert remains active. Exchanges and wallet providers continue to monitor the listed addresses. Further freezes are possible if the attackers move funds through regulated platforms. The attribution strengthens the existing case that TraderTraitor functions as a state-directed unit rather than an independent criminal group. U.S. authorities have previously sanctioned related entities and individuals tied to North Korean cyber operations.

The combination of a single compromised endpoint, rapid multi-chain extraction and automated laundering leaves exchanges with a narrow window for response. Binance’s decision to cover the loss from its own balance sheet limits immediate customer harm but does not change the underlying security exposure that allowed the initial access.