FBI links $6 billion Binance theft to North Korean hackers

The FBI said on Oct. 31 that North Korean hackers stole more than $6 billion in virtual assets from Binance on Oct. 29, in a theft that appears to be the largest crypto heist on record.

• FBI’s estimate: more than $6 billion stolen.
• Binance incident date: on or about Oct. 29, 2026.
• Binance has set aside more than $6.34 billion to cover losses, AP reported.

The bureau identified the activity as TraderTraitor, a name it uses for a North Korean cyber operation. In its Oct. 31 alert, the FBI said it had observed the attackers converting stolen assets primarily into Ethereum. It urged crypto services to block transactions connected to listed wallet addresses.

How does the FBI say the stolen assets are moving?

The FBI said TraderTraitor was converting the assets mainly into Ethereum and could move them next through decentralised finance services and instant swaps, which let users exchange crypto quickly. The bureau said those steps could help prepare the funds for further laundering.

The FBI, the U.S. Secret Service and the Internal Revenue Service’s Criminal Investigation division urged node operators, exchanges, DeFi services and blockchain analytics firms to block transactions linked to the addresses. The FBI alert lists wallets it says are operated by or closely connected to TraderTraitor.

The FBI’s account names the suspected group and describes its view of the money’s movement. It does not provide a public explanation of how the attackers gained access to Binance’s systems.

What is known about how the attack happened?

Binance said the theft involved its own hot wallet, an internet-connected wallet used to process transactions. The company’s co-chief executive Richard Teng said the exchange was investigating and working with law enforcement and blockchain firms to trace and recover assets, according to the Associated Press report.

In a separate report, AP said Binance’s initial investigation raised the possibility of a compromised laptop, but a later investigation found additional points of breach. Binance has said deposits were unaffected and that it would cover customer losses. The exchange has not publicly confirmed the FBI’s attribution, telling AP it was working with law enforcement to identify the criminals.

Why does this attribution matter?

The FBI’s warning gives exchanges and other crypto services wallet addresses to watch as they try to stop the stolen funds from being moved or converted. The bureau says the assets are already being shifted into Ethereum and could face further laundering.

TraderTraitor is also the name the FBI used in its February 2025 attribution of the $1.5 billion Bybit hack to North Korea. The Binance theft would exceed that haul and set a new record by dollar value, based on figures reported by AP.

AP reported that Binance had frozen roughly $3 billion in affected assets with help from blockchain partners. The FBI’s Oct. 31 alert, however, did not give a recovery total. It asked private firms to block transactions connected to the listed addresses as investigators and crypto services track the funds.

Sources and documents

• Oct. 31 alert — fbi.gov
• Associated Press report — apnews.com