FBI Attributes Record $6 Billion Binance Crypto Theft to North Korea

The Federal Bureau of Investigation attributed the theft of more than $6 billion in virtual assets from the cryptocurrency exchange Binance to North Korea. The FBI released the assessment on 31 October 2026, stating that the Democratic People’s Republic of Korea was responsible for the theft that occurred on or about 29 October. The agency named the activity TraderTraitor, the same designation used for earlier North Korean operations including the $1.5 billion Bybit theft in 2025.

Blockchain analytics firms had already linked the attack to North Korean groups. TRM Labs calculated approximately $6.36 billion moved from Binance wallets across ten blockchains, most of it in roughly 20 minutes beginning at 20:05 UTC on 29 October. Elliptic placed the total at $6.43 billion and described it as the largest single theft of any kind in history. Chainalysis estimated about $6.4 billion. The haul was roughly four times the previous record set by the Bybit incident.

The FBI, working with the US Secret Service and IRS Criminal Investigation, observed TraderTraitor actors converting stolen assets primarily into Ethereum. The bureau expects further laundering through decentralised finance protocols and instant swap services. Roughly $2.7 billion has been frozen on-chain by stablecoin issuers and one network’s security council. About $2.4 billion remains in assets that no issuer can freeze. Binance stated it had set aside more than $6.34 billion in company funds to cover the financial impact and resumed withdrawals in phases starting on 1 November.

Early statements from Binance pointed to a compromised DevOps engineer’s laptop that allowed an attacker to reach a service container and submit unauthorised withdrawal transactions. The company later described the intrusion as a complex process involving additional points of breach and not the work of a single individual. Customers withdrew approximately $3.7 billion in the hours after withdrawals reopened, according to DefiLlama data. Binance’s total assets exceed $150 billion, so the outflows did not threaten the exchange’s solvency, but they illustrated the speed at which users can exit a centralised platform after a major breach.

TraderTraitor forms part of the wider Lazarus Group structure. North Korea’s cyber operations have previously been linked to thefts that fund weapons programmes. The Binance incident nearly doubles the cumulative value of cryptocurrency previously attributed to the regime in public tallies by analytics firms. The FBI listed hundreds of Ethereum addresses, 19 Bitcoin addresses and one Solana address associated with the stolen funds and advised exchanges and service providers to block them.

The attack occurred across Ethereum, Bitcoin, Tron, XRP Ledger, Solana and other chains. On Ethereum alone, roughly 200,630 ETH and large quantities of USDT, USDC and other tokens were taken. The speed of the transfers, concentrated in a 20-minute window, limited the window for real-time intervention. Freezes of stablecoins accounted for the largest recoverable portion. Assets that cannot be frozen continue to move through mixers and cross-chain bridges.

Binance co-CEO Richard Teng stated that the attack was not a one-click event. The exchange’s commitment to full coverage of user losses means the immediate financial hit falls on the company rather than individual account holders. Longer-term effects include tighter scrutiny of hot-wallet security practices at centralised exchanges and continued pressure on North Korean cyber units through sanctions and blockchain tracing. The FBI’s public attribution supplies a named actor and a set of addresses that service providers can act on while the remaining unfrozen funds continue to circulate.