FBI Attributes Record $6.3 Billion Binance Theft to North Korea's TraderTraitor Group

The Federal Bureau of Investigation said on 31 October that North Korea was responsible for the theft of more than $6 billion in virtual assets from the cryptocurrency exchange Binance on or about 29 October. The bureau named the activity TraderTraitor, the same designation it has used for earlier high-value cryptocurrency thefts linked to North Korean operators.

Working with the US Secret Service and IRS Criminal Investigation, the FBI observed the actors converting stolen assets primarily into Ethereum. It expects further movement through decentralised finance platforms and instant-swap services. The bureau published a list of Ethereum, Bitcoin and Solana addresses it says are operated by or closely connected to the group and asked virtual asset service providers to block related transactions.

Blockchain analysis firms had reached a similar conclusion before the FBI statement. TRM Labs estimated that approximately $6.36 billion left Binance wallets across ten blockchains, with the bulk moved in roughly 20 minutes starting at 20:05 UTC on 29 October. A second wave followed later that day on Avalanche and Polygon. Chainalysis and Elliptic produced comparable figures. Elliptic calculated $6.43 billion and noted that the single incident nearly doubled the total cryptoassets previously attributed to the regime.

Binance said it had replaced about 90 to 95 percent of the stolen tokens by buying them on the open market with company funds and that user balances would not absorb the loss. The remaining portion consisted of less liquid tokens that would take longer to replace. Bitcoin withdrawals resumed on 1 November; other assets were scheduled to follow in phases.

TraderTraitor has been tracked by US agencies since at least a 2022 joint advisory from the FBI, CISA and the Treasury Department. That warning described the group’s use of malicious software and social-engineering techniques against software developers and IT staff at cryptocurrency companies. Earlier major incidents attributed to the same operators include the $1.5 billion Bybit theft in February 2025. North Korea has long used cryptocurrency theft and remote IT worker schemes to generate foreign currency outside the formal banking system and to support weapons programmes.

The scale of the Binance loss places it among the largest publicly attributed cryptocurrency heists. Freezes by issuers of major stablecoins, including Tether and Circle, recovered portions of the funds on-chain, but the remainder continues to move. The FBI’s advisory and the address list are intended to slow that movement before the assets reach further mixing stages.

For exchanges and on-chain services the practical effect is immediate: any transaction involving the listed addresses carries elevated risk of later recovery action or law-enforcement interest. For North Korea the theft supplies a large, hard-currency resource that does not depend on traditional trade channels. The incident also tests whether the largest centralised exchanges can absorb multi-billion-dollar losses without restricting user withdrawals for long periods.