The FBI has formally blamed North Korea for the $6.3 billion theft from Binance, figuring out a state-sponsored hacking operation referred to as TraderTraitor as liable for what’s being described as one of many largest cryptocurrency heists on file.
In an announcement launched Saturday, the FBI mentioned North Korean hackers stole greater than $6 billion in digital belongings from the world’s largest cryptocurrency trade on or round October 29, 2026. The company added that it had been monitoring the stolen funds because the attackers moved them throughout blockchain networks.
“The FBI refers to this particular North Korean malicious cyber exercise as ‘TraderTraitor,’” the company mentioned, warning that the stolen belongings had been more likely to bear additional laundering by DeFi platforms and immediate token-swapping providers.
Based on the FBI, investigators have noticed the hackers changing a lot of the stolen cryptocurrency into Ethereum (ETH), probably as an preliminary step in a broader effort to hide the funds’ origins and make them more durable to recuperate.
North Korea-linked TraderTraitor behind the assault
TraderTraitor is recognized by the US Cybersecurity and Infrastructure Safety Company (CISA) as a North Korean state-sponsored hacking group concerned in cryptocurrency thefts and cyberattacks since not less than 2020.
The group is believed to be related to the Lazarus Group, a hacking community that has repeatedly focused cryptocurrency firms, blockchain platforms and expertise builders. Its operations have included spear-phishing campaigns and malware designed to compromise programs and achieve entry to digital belongings.
The newest attribution provides to a rising listing of main cryptocurrency thefts linked to North Korea. TraderTraitor was additionally blamed by the FBI for the $1.5 billion Bybit hack in 2025, which was thought-about the most important single crypto theft on the time.
Blockchain intelligence companies Chainalysis and TRM Labs had beforehand attributed the Binance incident to North Korean hackers earlier than the FBI publicly confirmed its findings.
How The Binance Hack Unfolded (Supply: Chainalysis)
North Korea-linked cyber operations have turn into a major concern for the worldwide cryptocurrency business. US officers and cybersecurity researchers have repeatedly warned that proceeds from these assaults could assist fund the nation’s weapons packages, making digital asset theft an vital income for the remoted nation.
Binance strikes to cowl the stolen funds
Following the assault, Binance briefly suspended deposits and withdrawals whereas its safety groups investigated the breach, secured affected infrastructure and labored with regulation enforcement businesses.
The trade initially mentioned its investigation had recognized a compromised laptop computer belonging to a DevOps engineer, a specialist liable for sustaining software program infrastructure and supporting IT operations. Nonetheless, Binance later confirmed that investigators had found extra factors of breach, with out offering additional technical particulars.
In a subsequent replace, the corporate mentioned it had contained the compromised infrastructure, revoked affected authorizations and launched extra safety controls to stop additional unauthorized entry.
Binance additionally moved rapidly to reassure clients that the incident wouldn’t lead to monetary losses for customers.
Co-CEO Richard Teng mentioned the trade had already replenished roughly 95% of the impacted belongings, with Binance taking accountability for the remaining losses.
Co-CEO Richard Teng’s Assertion on X (Supply: X)
The remaining 5% consists of much less liquid tokens, which means Binance may have extra time to buy the belongings required to finish the reimbursement.
The trade has additionally begun restoring buyer entry, with withdrawals resuming in phases after the momentary suspension.
Crypto exchanges tighten safety after the heist
The dimensions of the Binance assault has prompted different main cryptocurrency platforms to assessment their safety preparations, highlighting issues concerning the dangers dealing with exchanges that maintain billions of {dollars} in buyer belongings.
Coinbase Chief Safety Officer Jeff Lunglhofer mentioned the US-based trade had made changes to its chilly storage programs as a precaution. Chilly storage retains non-public keys offline, decreasing publicity to internet-based assaults.
In the meantime, Kraken mentioned it was monitoring developments and that its providers remained operational. Gemini additionally launched extra alerts and restrictions to observe probably suspicious actions of funds.
Coinbase executives additional highlighted the rising risk of social engineering, significantly rip-off calls wherein criminals try to steer customers to alter safety settings or disclose delicate data.
OKX CEO Star Xu referred to as for stronger cooperation throughout the business, together with real-time safety incident notifications, coordinated monitoring of suspicious transactions and quicker responses to potential assaults. He additionally careworn the necessity to strengthen defenses towards rising AI-powered safety threats.
Monitoring the stolen belongings stays a problem
Though Binance has dedicated to overlaying buyer losses, recovering the stolen cryptocurrency and figuring out these accountable stay troublesome duties.
The FBI mentioned it had noticed TraderTraitor shifting the stolen belongings primarily into Ethereum and warned that the hackers may use DeFi platforms and immediate swap providers to additional obscure transaction trails.
Chainalysis additionally reported that the attackers used automated instruments to maneuver stolen funds throughout the Tron community after extracting them from Binance.
Nonetheless, blockchain transactions are recorded on public ledgers, permitting investigators and blockchain analytics companies to observe fund actions and establish suspicious patterns. This transparency may present alternatives to freeze belongings after they attain cooperating exchanges or different regulated providers.
Ari Redbord, chief coverage officer at TRM Labs, in contrast the incident to a financial institution theft carried out at web velocity, whereas noting that blockchain monitoring permits investigators to comply with the cash in actual time.
He expects the hackers to divide the stolen belongings into smaller quantities and transfer them by a number of exchanges and providers, a course of that would take months.
The Binance incident underscores the rising sophistication of cyberattacks focusing on the digital asset business. Whereas blockchain transparency and cooperation between exchanges and regulation enforcement may help investigators hint stolen funds, the size of the theft highlights how weak even the most important cryptocurrency platforms can stay to more and more advanced assaults.
