FBI Links $6.3 Billion Binance Theft to North Korean Hackers

The FBI has attributed the theft of more than $6 billion in virtual assets from Binance to TraderTraitor, a North Korean state-sponsored hacking group. The agency said the theft occurred on or about October 29, 2026. Blockchain intelligence firms TRM Labs and Chainalysis had also linked the attack to TraderTraitor.

Binance said the breach began with a compromised DevOps engineer’s laptop, which gave attackers access to a service container and allowed them to submit unauthorized withdrawal transactions. About $6.36 billion in cryptocurrency was stolen across ten blockchains, with most of the funds transferred in 20 minutes.

The FBI says it has observed TraderTraitor converting stolen assets mainly into Ethereum. It expects the funds may be laundered further through decentralized finance platforms and instant swap services. The FBI, U.S. Secret Service and IRS Criminal Investigation are asking virtual asset service providers to block transactions tied to the laundering addresses. The FBI published 628 associated cryptocurrency addresses: 608 Ethereum, 19 Bitcoin and one Solana.

Binance told BleepingComputer it was preparing to resume the first phase of withdrawals on November 1, between 06:00 and 09:00 UTC. It said it had covered about 95% of the impacted amount, with the remaining 5% consisting of less-liquid tokens it was still purchasing. Binance also said listed BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances were fully backed, and deposits remained unaffected. The company said it would bear the financial impact of the stolen funds.