The FBI has formally blamed North Korea for the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance, in what was already the largest crypto theft on record.
In a notice published on Saturday, the bureau said the Democratic People’s Republic of Korea was responsible for the theft, on or about 29 October, and identified the activity as “TraderTraitor”. The announcement turns what had been an attribution by private blockchain analysts into an official United States government finding, two days after the heist.
Working with the US Secret Service and IRS Criminal Investigation, the FBI said TraderTraitor actors had been observed converting the stolen assets primarily into Ethereum. It warned that the funds were expected to be laundered further using decentralised finance and instant-swap services, as the actors prepared them for later laundering stages.
The bureau urged crypto businesses — including node operators, instant exchanges, decentralised finance services, blockchain analytics firms and other virtual-asset providers — to block transactions with, or derived from, addresses it linked to the theft, and it published a list of those addresses. The move is aimed at choking off the route by which stolen funds are typically washed and cashed out.
The theft itself unfolded with extraordinary speed. On 29 October, attackers drained roughly $6.3 billion from Binance hot wallets across about ten blockchains, most of it in around 20 minutes, according to blockchain intelligence firms TRM Labs and Chainalysis. That dwarfs the previous record, the $1.5 billion Bybit theft of February 2025, which the FBI also blamed on TraderTraitor.
Binance, the world’s largest crypto exchange, suspended withdrawals after the attack and pledged to cover all user losses. Stablecoin issuers moved quickly to freeze a large share of the haul — analysts estimate roughly $3 billion has been frozen — but billions more in Bitcoin, Ethereum and other assets remain outside any issuer’s power to freeze, and continue to move.
The attribution matters beyond the size of the loss. US officials and researchers have long warned that North Korea uses crypto theft to fund its government and weapons programmes, and the scale of the Binance heist — more than four times the Bybit theft — suggests that revenue stream has grown sharply. The FBI notice does not publish its full underlying evidence, and its attribution rests alongside the analysts’ on-chain findings; Pyongyang has not been reported as responding to this specific allegation.
For exchanges and crypto services, the immediate test is practical: whether the FBI’s address list and the industry’s freezing efforts can keep pace with a laundering operation that is already shifting funds into Ethereum and through decentralised channels. For users, Binance’s pledge to cover losses limits the direct damage — but the episode is a stark reminder of how much value can move, and vanish, in minutes.
Sources: Federal Bureau of Investigation, “North Korea Responsible for $6 Billion+ Binance Attack” (31 October 2026), https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack ; Reuters, “FBI links North Korea to theft of $6 billion from Binance” (31 October 2026), https://www.reuters.com/world/fbi-links-north-korea-theft-6-billion-from-binance-2026-10-31/
