FBI blames North Korea's TraderTraitor for $6 billion Binance crypto heist

Washington: The Federal Bureau of Investigation (FBI) has attributed the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance to North Korea, warning that the stolen funds are being converted into Ethereum and could be routed through decentralised finance (DeFi) platforms and instant-swap services to disguise their origin.

In a cyber advisory issued on October 31, the FBI identified the campaign as "TraderTraitor" and stated that the breach took place on or around October 29, 2026.

The agency, collaborating with the U.S. Secret Service (USSS) and the Internal Revenue Service's Criminal Investigation division (IRS-CI), noted that investigators had observed the attackers converting the stolen digital assets predominantly into Ethereum (ETH).

Federal authorities urged cryptocurrency exchanges, THORNode and RPC node operators, DeFi platforms, instant swap services, blockchain analytics firms, and other virtual asset service providers to block transactions linked to wallet addresses associated with the stolen capital.

The FBI also published an inventory of cryptocurrency addresses currently or previously holding assets tied to the breach, requesting that financial institutions and service providers intercept any transactions originating from or connected to those addresses.

ALSO READ: Binance Hacked: $6.3 Billion Crypto Exchange Heist Explained

The security breach was initially disclosed on October 30, a day after billions of dollars in digital currency were transferred out of Binance-controlled wallets on October 29. Approximately $6.36 billion in virtual assets was moved across 10 distinct blockchain networks. Binance initially announced it was looking into a potential security incident and temporarily suspended withdrawals across several networks as a precautionary measure.

The TraderTraitor designation has previously been used by U.S. law enforcement agencies to classify North Korean-backed cyber operations targeting digital asset platforms. The FBI has linked this activity to threat groups also identified as Lazarus Group and APT38.

In February 2025, the FBI attributed the theft of roughly $1.5 billion in virtual assets from cryptocurrency exchange Bybit to the same North Korean cyber threat actors. At the time, federal officials noted that the perpetrators were distributing the stolen assets across thousands of addresses and multiple blockchains to facilitate complex laundering operations.

The FBI has additionally tied TraderTraitor-affiliated actors to earlier high-profile cryptocurrency thefts, including cyberattacks against Alphapo, CoinsPaid, and Atomic Wallet in 2023. Federal officials warned that North Korea systematically relies on cybercrime and virtual asset theft to generate revenue for the regime.

The FBI requested that anyone possessing relevant information contact a local FBI field office or submit a report via the Internet Crime Complaint Centre.

ANI