Skip to main content
Crypto Readout

Crypto markets, protocols and policy

FBI links $6bn Binance theft to North Korea’s TraderTraitor

The FBI says North Korea stole more than $6 billion from Binance on Oct. 29, naming TraderTraitor and urging crypto firms to block addresses used to move funds.

By Crypto Readout Editorial3 min read#82076e

FBI links $6bn Binance theft to North Korea’s TraderTraitor

The FBI says North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or about Oct. 29, identifying the operation as TraderTraitor. The theft, which AP reports took place within minutes, is the largest cryptocurrency heist on record. The FBI’s attribution and its request to block transactions were reported by The Associated Press.

The FBI, working with the U.S. Secret Service and IRS Criminal Investigation, says it observed the stolen assets being converted primarily into Ethereum. It expects the attackers to move them through decentralized finance (DeFi) platforms and instant swap services, which let users exchange one digital asset for another. Each conversion can change the asset and the address holding it, complicating efforts to trace and stop the funds.

What does the FBI say happened to the stolen assets?

The reported sequence is theft from Binance, followed by conversion into Ethereum and anticipated transfers through DeFi and instant swaps. The FBI identifies TraderTraitor as the North Korean cyber operation behind the theft. The agency’s announcement, as reported by Yonhap News Agency, does not explain how the attackers gained access or describe the technical method used to remove the assets.

Think of an instant swap as a currency exchange counter: the holder can trade one token for another without returning to a conventional exchange. In crypto, those trades are recorded on blockchains, but assets can pass through multiple services and addresses. The FBI says further laundering is expected; it has not said that all the stolen assets have already moved through these services.

Who is being asked to block the funds?

The FBI, Secret Service and IRS Criminal Investigation urged private-sector firms to block transactions involving addresses linked to the laundering activity. Their request covers THORNode and RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual-asset providers.

A block by one service can prevent a transaction from passing through that service. It does not reverse the original theft or automatically prevent transfers through every other service. The agencies’ request is aimed at disrupting the next steps in the movement of the funds while investigators and firms follow the listed addresses.

What does the FBI’s attribution establish?

It establishes the U.S. bureau’s public attribution of this theft to North Korea and its TraderTraitor label for the activity. It does not, by itself, identify individual perpetrators or set out the evidence behind the attribution. The FBI previously associated TraderTraitor with the $1.5 billion Bybit theft in 2025, according to AP.

For Binance users, the immediate scale is clear: more than $6 billion in digital assets was stolen. The FBI’s alert focuses on tracking and blocking the funds as they move. It does not specify a recovery total or say how much of the stolen value has been recovered.

Sources