FBI links $6 billion Binance theft to North Korea

The FBI says North Korean hackers stole more than $6 billion in virtual assets from Binance on or about October 29, 2026, and are converting the funds into Ether. The bureau named the activity TraderTraitor and urged crypto services to block transfers linked to the theft, according to its October 31 alert.

Binance holds digital assets in wallets used to process customer activity across cryptocurrency networks. An attacker who can trigger unauthorized withdrawals can move assets out of those wallets to addresses they control. Binance’s preliminary investigation pointed to a compromised laptop belonging to an engineer, followed by access to an internal service and unauthorized withdrawal requests, Nextgov/FCW reported.

How much was taken, and how did the theft happen?

Blockchain intelligence firm TRM Labs estimated that hackers transferred $6.36 billion from Binance wallets, with most of the transfers occurring in about 20 minutes. The FBI’s public alert gives a rounded figure of more than $6 billion and dates the theft to on or about October 29. Nextgov/FCW reported that researchers described it as the largest cryptocurrency theft on record.

The available reporting describes the entry point and the withdrawals, but does not give a complete technical account of how the attackers moved from the compromised laptop to control of the internal service. The FBI’s attribution identifies TraderTraitor, which it describes as North Korean malicious cyber activity. TRM also attributed the attack to TraderTraitor, according to Nextgov/FCW’s report on the theft.

What is happening to the stolen assets now?

The FBI says it has observed the attackers converting the stolen assets primarily into Ether, or ETH. It expects them to use decentralized finance services and instant swap services for further laundering. In a swap, one digital asset is exchanged for another; moving value through different assets and services can make the trail harder to follow, though investigators can still track transactions on public blockchains.

The FBI, the U.S. Secret Service and the IRS Criminal Investigation division asked node operators, exchanges, DeFi services and other virtual-asset providers to block transactions involving addresses associated with TraderTraitor. The bureau published a list of addresses that it says are holding or have held assets from the theft and are operated by, or closely connected to, the group.

What does the attribution mean for Binance customers?

The FBI’s notice is an attribution and a request to disrupt transfers; it does not provide a final accounting of recovered funds. Nextgov/FCW reported that Binance pledged to cover losses using its emergency protection fund and company money. The exchange’s stated response addresses customer balances, while investigators and blockchain firms continue tracing the assets and asking services to stop their movement.

Sources

• October 31 alert — fbi.gov
• report on the theft — nextgov.com