FBI Blames North Korean Hackers for Record $6.3 Billion Binance Theft

The FBI has officially blamed North Korea for the $6.3 billion theft from Binance, identifying a state-sponsored hacking operation known as TraderTraitor as responsible for what is being described as one of the largest cryptocurrency heists on record.

In a statement released Saturday, the FBI said North Korean hackers stole more than $6 billion in virtual assets from the world’s largest cryptocurrency exchange on or around October 29, 2026. The agency added that it had been tracking the stolen funds as the attackers moved them across blockchain networks.

“The FBI refers to this specific North Korean malicious cyber activity as ‘TraderTraitor,’” the agency said, warning that the stolen assets were likely to undergo further laundering through DeFi platforms and instant token-swapping services.

According to the FBI, investigators have observed the hackers converting much of the stolen cryptocurrency into Ethereum (ETH), potentially as an initial step in a broader effort to conceal the funds’ origins and make them harder to recover.

North Korea-linked TraderTraitor behind the attack

TraderTraitor is identified by the US Cybersecurity and Infrastructure Security Agency (CISA) as a North Korean state-sponsored hacking group involved in cryptocurrency thefts and cyberattacks since at least 2020.

The group is believed to be associated with the Lazarus Group, a hacking network that has repeatedly targeted cryptocurrency companies, blockchain platforms and technology developers. Its operations have included spear-phishing campaigns and malware designed to compromise systems and gain access to digital assets.

The latest attribution adds to a growing list of major cryptocurrency thefts linked to North Korea. TraderTraitor was also blamed by the FBI for the $1.5 billion Bybit hack in 2025, which was considered the largest single crypto theft at the time.

Blockchain intelligence firms Chainalysis and TRM Labs had previously attributed the Binance incident to North Korean hackers before the FBI publicly confirmed its findings.

How The Binance Hack Unfolded (Source: Chainalysis)

North Korea-linked cyber operations have become a significant concern for the global cryptocurrency industry. US officials and cybersecurity researchers have repeatedly warned that proceeds from these attacks may help fund the country’s weapons programs, making digital asset theft an important source of revenue for the isolated nation.

Binance moves to cover the stolen funds

Following the attack, Binance temporarily suspended deposits and withdrawals while its security teams investigated the breach, secured affected infrastructure and worked with law enforcement agencies.

The exchange initially said its investigation had identified a compromised laptop belonging to a DevOps engineer, a specialist responsible for maintaining software infrastructure and supporting IT operations. However, Binance later confirmed that investigators had discovered additional points of breach, without providing further technical details.

In a subsequent update, the company said it had contained the compromised infrastructure, revoked affected authorizations and introduced additional security controls to prevent further unauthorized access.

Binance also moved quickly to reassure customers that the incident would not result in financial losses for users.

Co-CEO Richard Teng said the exchange had already replenished approximately 95% of the impacted assets, with Binance taking responsibility for the remaining losses.

Co-CEO Richard Teng’s Statement on X (Source: X)

The remaining 5% consists of less liquid tokens, meaning Binance may need additional time to purchase the assets required to complete the reimbursement.

The exchange has also begun restoring customer access, with withdrawals resuming in phases after the temporary suspension.

Crypto exchanges tighten security after the heist

The scale of the Binance attack has prompted other major cryptocurrency platforms to review their security arrangements, highlighting concerns about the risks facing exchanges that hold billions of dollars in customer assets.

Coinbase Chief Security Officer Jeff Lunglhofer said the US-based exchange had made adjustments to its cold storage systems as a precaution. Cold storage keeps private keys offline, reducing exposure to internet-based attacks.

Meanwhile, Kraken said it was monitoring developments and that its services remained operational. Gemini also introduced additional alerts and restrictions to monitor potentially suspicious movements of funds.

Coinbase executives further highlighted the growing threat of social engineering, particularly scam calls in which criminals attempt to persuade users to change security settings or disclose sensitive information.

OKX CEO Star Xu called for stronger cooperation across the industry, including real-time security incident notifications, coordinated monitoring of suspicious transactions and faster responses to potential attacks. He also stressed the need to strengthen defenses against emerging AI-powered security threats.

Tracking the stolen assets remains a challenge

Although Binance has committed to covering customer losses, recovering the stolen cryptocurrency and identifying those responsible remain difficult tasks.

The FBI said it had observed TraderTraitor moving the stolen assets primarily into Ethereum and warned that the hackers could use DeFi platforms and instant swap services to further obscure transaction trails.

Chainalysis also reported that the attackers used automated tools to move stolen funds across the Tron network after extracting them from Binance.

However, blockchain transactions are recorded on public ledgers, allowing investigators and blockchain analytics firms to monitor fund movements and identify suspicious patterns. This transparency could provide opportunities to freeze assets when they reach cooperating exchanges or other regulated services.

Ari Redbord, chief policy officer at TRM Labs, compared the incident to a bank robbery carried out at internet speed, while noting that blockchain tracking allows investigators to follow the money in real time.

He expects the hackers to divide the stolen assets into smaller amounts and move them through multiple exchanges and services, a process that could take months.

The Binance incident underscores the growing sophistication of cyberattacks targeting the digital asset industry. While blockchain transparency and cooperation between exchanges and law enforcement can help investigators trace stolen funds, the scale of the theft highlights how vulnerable even the largest cryptocurrency platforms can remain to increasingly complex attacks.