FBI Attributes Record $6.3 Billion Binance Cryptocurrency Theft to North Korea's TraderTraitor Group

The FBI stated on 31 October 2026 that North Korea’s TraderTraitor group carried out the theft of more than $6 billion in cryptocurrency from Binance on or about 29 October.

Hackers drained multiple hot wallets across blockchains in roughly 20 minutes. Binance placed the loss near $6.3 billion, the largest recorded cryptocurrency theft. Blockchain analysis firms TRM Labs and Chainalysis had earlier linked the activity to TraderTraitor, a subunit associated with North Korea’s Lazarus Group.

The FBI, working with the U.S. Secret Service and IRS Criminal Investigation, observed the actors converting stolen assets primarily into Ethereum. The agency expected further laundering through decentralized finance platforms and instant-swap services. It released a list of more than 600 addresses tied to the operation and urged exchanges and other firms to block transactions involving those addresses.

Elliptic estimated the total at $6.43 billion across 11 blockchains. Of that amount, roughly $2.85 billion had been frozen or seized on-chain by early November. The remaining balance, about $3.25 billion, sat in more than 800 addresses that issuers could not freeze.

Binance said the intrusion may have begun with a compromised DevOps engineer’s laptop. The exchange pledged to cover customer losses and reopened withdrawals after an initial freeze. The speed of the drain indicated automated tools rather than manual transfers.

TraderTraitor has previously targeted cryptocurrency exchanges and firms. North Korean groups have used stolen digital assets to generate hard currency for the regime’s programs. The scale of the Binance operation exceeds earlier incidents by a wide margin.

Laundering has relied on rapid, automated swaps that obscure the origin of funds before they reach cash-out points. Investigators face difficulty once assets move into privacy-preserving or cross-chain services. Freezing remains effective only for tokens that centralized issuers can control.

The FBI’s public notice on 31 October provided industry participants with specific addresses to monitor. Compliance teams at major exchanges began screening deposits against the list. The agency did not release detailed technical indicators beyond the attribution and the observed conversion pattern.

North Korean cyber operations have grown more sophisticated in target selection and operational tempo. The Binance theft occurred during a period of elevated market volumes, which may have complicated real-time detection. Recovery efforts now depend on cooperation from private firms and on-chain monitoring rather than traditional law-enforcement seizures.

By 2 November, a portion of the funds remained in motion. Analysts tracked clusters of Ethereum addresses receiving the converted assets. Further movement into decentralized protocols was expected in the following days.

The incident has prompted renewed discussion of hot-wallet security and multi-signature controls at large exchanges. Binance’s decision to reimburse customers shifts the immediate financial impact to the company while law enforcement pursues the proceeds. Long-term recovery rates for North Korean cryptocurrency thefts have historically been low once funds leave the initial wallets.

U.S. agencies continue to update the address list as new clusters appear. Industry participants have been asked to report any deposits matching the published identifiers. The combination of speed, automation and cross-chain movement makes this the most complex laundering operation linked to a single North Korean theft to date.