FBI Attributes Record $6.3 Billion Binance Cryptocurrency Theft to North Korean Hackers

The FBI attributed the theft of approximately $6.3 billion in cryptocurrency from Binance to North Korean state-sponsored hackers known as TraderTraitor.

The attack occurred on 29 October 2026. Hackers emptied hot wallets across multiple blockchains, moving most of the funds in about 20 minutes. Blockchain analysis firms TRM Labs and Elliptic estimated the total between $6.3 billion and $6.43 billion, making it the largest cryptocurrency theft on record. It exceeded the $1.5 billion taken from Bybit in February 2025 by more than four times. The same TraderTraitor group was blamed for the Bybit incident.

The FBI, working with the U.S. Secret Service and IRS Criminal Investigation, released its attribution on 31 October. It listed 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address that currently hold or previously held proceeds of the theft. The bureau said the actors have been converting stolen assets primarily into Ethereum and are expected to launder them further through decentralised finance and instant-swap services.

Binance said it has covered 90 percent of the losses by using company funds to purchase replacement tokens. The remaining 10 percent consists of less liquid tokens that will take longer to acquire. The exchange stated that users will not bear the financial impact. It initially pointed to a compromised laptop belonging to a DevOps engineer and later said its investigation found additional points of breach. Withdrawals were suspended and then resumed in phases.

Elliptic estimated that about $2.85 billion of the stolen assets had been frozen or seized on-chain, leaving roughly $3.25 billion under attacker control across more than 800 addresses. TRM Labs described the outflow as occurring on ten blockchains. The FBI called on virtual asset service providers, THORChain node operators, RPC providers, and analytics firms to block transactions involving the listed addresses.

President Donald Trump, speaking in Florida on 31 October, said it was not yet clear whether North Korea was responsible. The FBI’s public attribution two days after the theft was more definitive. North Korean cyber operations have previously been linked to multiple large cryptocurrency thefts used to generate revenue for the state.

The speed of the extraction, concentrated in roughly 20 minutes starting around 4:00 p.m. U.S. Eastern time on 29 October, limited the window for intervention. Binance’s decision to absorb the losses protects individual account holders but represents a substantial internal cost for the exchange. The remaining unfrozen assets continue to move through mixers and cross-chain services.

For the broader cryptocurrency industry, the incident highlights the concentration of risk in large centralised exchanges and the difficulty of recovering funds once they leave hot wallets. The FBI’s publication of specific addresses gives exchanges and analytics firms a concrete list to monitor and block. How much of the $3.25 billion still under attacker control is ultimately recovered or permanently laundered will depend on the effectiveness of those blocks and any further seizures.

The attribution rests on blockchain tracing patterns previously associated with TraderTraitor and on the FBI’s own investigation. No public statement from North Korean authorities has addressed the claim. The confirmed facts as of early November are the scale of the theft, the timeline of the extraction, Binance’s coverage commitment, the listed addresses, and the FBI’s identification of TraderTraitor as the responsible group.