FBI Attributes Record $6.3 Billion Binance Hack to North Korea's TraderTraitor

On October 29, 2026 attackers drained approximately $6.3 billion to $6.4 billion from Binance hot wallets across 10 to 11 blockchains in roughly 20 minutes. The FBI attributed the theft to TraderTraitor, a North Korean state-sponsored hacking group also linked to the $1.5 billion Bybit hack of February 2025.

TRM Labs calculated about $6.36 billion moved, mostly in a short window starting around 4:05 p.m. ET. Chainalysis estimated $6.4 billion. Elliptic put the figure at $6.43 billion. Binance stated the impact at around $6.3 billion and said the intrusion began with a compromised engineer’s laptop.

The attacker staged operations at least 36 hours earlier, funding wallets with small Tornado Cash withdrawals and testing malicious code on three wallets. On Ethereum the group used EIP-7702 to convert a Binance hot wallet into a controlled sweeper. Funds left across Bitcoin, Ethereum, stablecoins and other assets. Most of the haul exited in one burst.

Binance halted withdrawals immediately and pledged to cover all user losses from company funds and the Secure Asset Fund for Users. By November 1 the exchange said it had reserved more than $6.34 billion, with $5 billion already held in the exact tokens stolen, and that roughly 90 percent of losses had been replaced. Withdrawals resumed in phases. Tether, Circle, Ripple and others froze about $2.67 billion to $3 billion in related assets. Arbitrum’s Security Council froze additional ETH and ARB.

As of early November roughly $3.24 billion remained in addresses linked to the theft, largely unmoved ETH and BTC. About $2.85 billion was frozen. Elliptic and other firms noted that North Korean groups have previously used Chinese money-laundering networks for cash-outs. In the Bybit case the group swapped large amounts of ETH for Bitcoin before attempting OTC exits.

Chainalysis observed on-chain commingling between Binance proceeds and funds from a prior Bitget exploit also attributed to North Korean actors. Pangolin Intelligence and TRM reached the same attribution with high confidence based on on-chain and off-chain indicators. The FBI confirmed the TraderTraitor link on October 31.

The scale exceeds any previous cryptocurrency theft. The Bybit incident had held the prior record. North Korean cyber operations have generated substantial revenue under sanctions, with this single haul estimated by some analysts at a large fraction of the country’s total reported revenue from all sources in 2025.

Binance’s initial proof-of-reserves report was targeted for release shortly after the incident. Institutional clients accelerated withdrawals from centralized exchanges in the days that followed. The breach highlighted risks in hot-wallet signing infrastructure used by large custodians.

Investigators continue to track remaining funds. Some stablecoins were frozen quickly; Bitcoin and Ethereum holdings proved harder to lock. The group’s operational pattern matches prior TraderTraitor campaigns in timing, tooling and laundering pathways.

Binance maintained that user deposits were unaffected and that company capital would make customers whole. The exchange had not publicly named a perpetrator at the time of the FBI statement. President Donald Trump, when asked, said the United States did not yet know if North Korea was responsible but would address it if confirmed.