FBI attributes record $6.3 billion Binance cryptocurrency theft to North Korean group TraderTraitor

The United States Federal Bureau of Investigation said on October 31 that North Korea was responsible for the theft of more than $6 billion in cryptocurrency from Binance on or about October 29. The bureau named the activity TraderTraitor, the same designation used for earlier North Korean operations against cryptocurrency platforms.

Binance, the largest exchange by trading volume, reported the loss at approximately $6.3 billion. Blockchain analysis firms TRM Labs and Elliptic placed the figure near $6.36 billion and $6.43 billion respectively. Most of the assets left Binance wallets across ten blockchain networks in roughly twenty minutes, beginning around 20:05 UTC on October 29, with a second wave later that evening.

The FBI, working with the United States Secret Service and the Internal Revenue Service Criminal Investigation division, observed the actors converting stolen tokens primarily into Ethereum. Officials expect further laundering through decentralized finance protocols and instant swap services. The bureau published lists of Ethereum, Bitcoin and Solana addresses linked to the activity and asked virtual asset service providers to block related transactions.

Binance stated on October 31 and November 1 that it had replaced about 90 percent of the stolen amount using company reserves. Major assets including Bitcoin, Ethereum, Tether and BNB were fully restored. The remaining portion consists of less liquid tokens that the company continues to purchase on the market and through over-the-counter deals. Binance said it would absorb the entire financial impact rather than pass losses to users. Withdrawals, suspended immediately after the theft, began to reopen in phases on November 1.

TraderTraitor is the same group previously linked by United States authorities to the $1.5 billion theft from the Dubai-based exchange Bybit in February 2025. North Korean state-linked cyber units have conducted large-scale cryptocurrency thefts for years, using proceeds to fund the regime and its weapons programs. The October 29 incident is the largest single cryptocurrency theft on record by a wide margin.

The speed of the movement across multiple chains limited the window for intervention. Analysts noted that the attackers used compromised credentials or infrastructure weaknesses to initiate the transfers. Binance has not publicly detailed the precise entry point. The company has said it is cooperating with law enforcement and has strengthened internal controls since the event.

Cryptocurrency markets showed limited immediate reaction after the FBI attribution. Bitcoin and Ethereum prices held relatively stable through November 1, reflecting the fact that Binance pledged full coverage. Longer-term effects may include higher insurance costs for exchanges, tighter custody rules, and continued pressure from regulators on platforms that hold large customer balances in hot wallets.

North Korean cyber operations have accounted for a substantial share of total cryptocurrency stolen globally in recent years. The latest theft nearly doubles the cumulative amount attributed to the regime in some private-sector estimates. United States agencies continue to track the laundering path and have asked industry participants to report any activity matching the published addresses to the Internet Crime Complaint Center or local FBI field offices.

The incident underscores the persistent capability of state-backed groups to target major exchanges despite improved security measures across the industry. Binance's decision to cover the loss from its own balance sheet prevents immediate customer harm but transfers the cost to the company and its shareholders. How effectively the stolen assets can be recovered or blocked will depend on the cooperation of other exchanges, blockchain analytics firms, and DeFi protocol operators in the coming weeks.