FBI Attributes Record $6.3 Billion Binance Hack to North Korea

The FBI on October 31, 2026, attributed the theft of more than $6 billion in cryptocurrency from Binance to North Korea’s TraderTraitor group. The attack, executed on or about October 29, is the largest crypto heist ever recorded, exceeding the $1.5 billion Bybit theft of 2025 by a wide margin.

Binance, the world’s largest exchange, suspended withdrawals after detecting the breach. Its initial investigation pointed to a compromised DevOps engineer’s laptop that allowed an attacker to reach a service container and submit unauthorized withdrawal transactions. Later statements indicated additional points of breach in a more complex operation. Blockchain analytics firms including TRM Labs, Elliptic, and Chainalysis had already linked the attack to North Korean actors before the FBI’s announcement. Elliptic estimated the haul at $6.43 billion across multiple chains, most of it moved in roughly 20 minutes.

TRM Labs traced the operation to staging at least 36 hours earlier, with small Tornado Cash withdrawals used to fund test wallets. On Ethereum, the attackers used EIP-7702 to convert a Binance hot wallet into a sweeper under their control. Funds moved across ten blockchains, including large amounts of ETH, USDT, USDC, and BTC. The FBI observed TraderTraitor converting stolen assets mainly into ether and preparing them for further laundering through decentralized finance and instant-swap services. It released lists of Ethereum, Bitcoin, and Solana addresses and urged private firms to block transactions involving those wallets.

Binance said it would cover all user losses from its Secure Asset Fund for Users and company reserves. By November 1 it reported that roughly 90 percent of the losses had been replaced and that withdrawals were resuming in phases, beginning with Bitcoin. About $3 billion of the stolen assets had been frozen on-chain through cooperation with partners. The exchange promised a full technical post-mortem and an updated proof-of-reserves report.

TraderTraitor is the FBI’s name for the same North Korean unit previously blamed for the Bybit and DMM Bitcoin hacks. The group is associated with the broader Lazarus Group, which has conducted state-linked cyber operations for years. North Korean cyber units have stolen an estimated $12.8 billion in cryptocurrency since 2017 across more than 100 incidents, according to TRM Labs. The Binance theft alone nearly doubles the regime’s known crypto haul from prior years.

The scale of the loss has prompted renewed scrutiny of hot-wallet security and multi-signature processes at major exchanges. Binance has not identified the specific employee whose laptop was compromised. Law-enforcement agencies in the United States and partner countries continue to track the remaining funds as they move through mixing services and cross-chain bridges. The FBI’s public attribution and address lists give exchanges and analytics firms a concrete list of wallets to monitor and freeze where possible.