FBI Attributes $6.3 Billion Binance Crypto Theft to North Korea
The FBI has attributed the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance to North Korean state-sponsored hackers operating under the name TraderTraitor. In an alert published on October 31, the agency said the theft took place on or around October 29, 2026. BleepingComputer reported the attribution on November 1. The Binance crypto theft is estimated at about $6.3 billion, although the FBI’s statement describes the amount as more than $6 billion.
The attribution adds a major state-backed cybercrime case to the risks facing cryptocurrency platforms. Investigators said the attackers were converting the stolen assets primarily into Ethereum and were expected to move them through decentralised finance (DeFi) platforms and instant-swap services to make further laundering more difficult to trace.
FBI links Binance crypto theft to TraderTraitor
The FBI identified the operation as TraderTraitor, a name previously associated with North Korean cyber activity targeting cryptocurrency and blockchain businesses. The agency said it was working with the US Secret Service and the Internal Revenue Service’s Criminal Investigation division to track the stolen funds.
The agencies published a list of cryptocurrency wallet addresses associated with the laundering activity and urged exchanges, DeFi services, blockchain infrastructure providers and other virtual-asset businesses to block transactions connected to those addresses. The alert also called on service providers to share relevant information with investigators.
Stolen assets moved into Ethereum and DeFi services
According to the FBI, the attackers were converting the stolen assets primarily into Ethereum. Investigators expect the funds to be moved through decentralised finance platforms and instant-swap services as part of subsequent laundering stages. These services can allow digital assets to be exchanged or routed across networks, complicating efforts to identify and freeze funds.
The FBI’s warning is directed at a broad group of cryptocurrency intermediaries, including node operators, instant exchanges, blockchain analytics firms and virtual-asset service providers. By publishing wallet addresses, investigators are seeking to make it harder for the attackers to convert or transfer the proceeds through the wider crypto ecosystem.
Binance says it has covered most of the reported loss
Binance told Reuters on October 31 that it had replaced about $6 billion of the $6.3 billion stolen, using company funds to buy replacement tokens. The exchange said the remaining losses were below 10% and involved less-liquid assets that could take longer to source. This refers to the exchange covering the financial shortfall, not recovering every stolen token.
Binance and industry partners had located about $3 billion in affected assets and were working to freeze them, Reuters reported. The exchange said its response drew on its Secure Asset Fund for Users, its Futures Insurance Fund and corporate treasury. Withdrawals, which had been suspended after the incident, were expected to resume on Sunday, according to the report.
North Korean crypto thefts keep pressure on the industry
The FBI’s attribution highlights the continuing threat posed by North Korean state-linked cyber operations to cryptocurrency businesses. Digital-asset theft can provide a source of funds for sanctioned actors, while laundering through multiple services and networks can make recovery difficult.
For exchanges and other service providers, the alert reinforces the importance of transaction monitoring, wallet screening and rapid cooperation with law enforcement. The investigation and asset-freezing effort are ongoing, and the FBI’s attribution does not mean that all stolen funds have been recovered or that the laundering process has been stopped.
