FBI Pins $6.3B Binance Heist on North Korea

The FBI on Oct. 31 blamed North Korea for stealing more than $6 billion in crypto from Binance around Oct. 29, saying the attack matters as the biggest crypto theft on record. The bureau named the activity TraderTraitor and urged crypto services to block transactions tied to the stolen funds, according to the FBI alert.

• About $6.3 billion was stolen, according to Binance and reporting by BleepingComputer.
• The attack took place on or about Oct. 29, 2026.
• Most of the funds moved in about 20 minutes.
• The FBI listed 628 addresses linked to the theft.

What did the FBI attribute to North Korea?

The FBI said North Korea was responsible for the theft and identified the activity as TraderTraitor. The group is also tracked under other names, including Lazarus Group, Jade Sleet and APT38, according to BleepingComputer’s report on the FBI alert.

The FBI’s notice followed earlier attributions from blockchain intelligence firms TRM Labs and Chainalysis, BleepingComputer reported. The bureau said the theft happened on or about Oct. 29. Binance and blockchain analysts put the amount at roughly $6.3 billion; the FBI’s alert described it as more than $6 billion.

That would make the Binance theft larger than the $1.5 billion Bybit hack in February 2025, which was also linked to TraderTraitor. BleepingComputer reported that about $6.36 billion moved across ten blockchains, with most of it transferred in roughly 20 minutes.

How did the attackers get the funds?

Binance linked the breach to a compromised laptop belonging to a DevOps engineer, a worker who manages software systems. The attackers used access to reach a service container and submit unauthorised withdrawal transactions, according to BleepingComputer’s account of Binance’s explanation.

Binance said the incident was more complex than a single employee permission or one-click action, and that it had not found evidence of a leaked wallet private key. The exchange had not attributed responsibility itself when it described the breach. The FBI’s later notice supplied the government’s attribution to North Korea.

The reported route into the exchange matters because the theft did not depend on a confirmed leak of private keys. Binance said it was investigating additional points of breach and working with law enforcement and blockchain intelligence partners to trace the assets.

Where is the stolen crypto moving now?

The FBI said it had observed TraderTraitor converting the stolen assets mainly into Ether. It expects the hackers to use decentralised finance services and instant crypto swaps to move the funds through further laundering stages. Decentralised finance, or DeFi, refers to financial services that run through blockchain software.

The FBI, US Secret Service and IRS Criminal Investigation asked exchanges, blockchain operators, DeFi services and other crypto businesses to block transactions linked to addresses used in the laundering. The agency published 628 addresses: 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address, BleepingComputer reported.

Blocking transactions could make it harder to move some funds through services that cooperate with the request, but it does not itself return the stolen assets to Binance. The FBI said the investigation was ongoing and asked companies to flag transactions involving the listed addresses. Binance said it would cover the losses from its own and its user-protection funds, according to BleepingComputer’s report on the breach.

Sources and documents

• FBI alert — fbi.gov
• BleepingComputer’s report on the FBI alert — bleepingcomputer.com