The FBI accused North Korea of stealing more than $6 billion in cryptocurrency from Binance in a cyberattack on Thursday, identifying the perpetrators as a North Korean hacking operation known as TraderTraitor, according to a statement released on Saturday.
The attack, which occurred on October 29, is believed to be the largest cryptocurrency theft in history, surpassing previous cyberattacks targeting digital asset exchanges.
In its official cybersecurity alert, the FBI attributed the theft to the Democratic People’s Republic of Korea (DPRK), North Korea’s official name, and warned that the hackers had already begun converting the stolen funds into other cryptocurrencies.
The FBI is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as “TraderTraitor.” The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages. How You Can Help: FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets. A list of addresses associated with this activity is available here: https://t.co/g0oIWx0WeD
— FBI Cyber Branch (@FBICyberBranch) October 31, 2026
Working alongside the US Secret Service and the Internal Revenue Service’s Criminal Investigation division, the bureau said investigators had observed TraderTraitor operatives converting stolen digital assets primarily into Ethereum (ETH), one of the world’s largest cryptocurrencies.
The agencies warned that the stolen assets were expected to undergo additional laundering through decentralized finance (DeFi) platforms and instant cryptocurrency exchange services, potentially complicating efforts to trace and recover the funds.
The blockchain intelligence firm TRM Labs estimated that approximately $6.36 billion was transferred from Binance wallets across 10 blockchain networks during the October 29 attack, with most of the assets moved in roughly 20 minutes. The firm attributed the operation to TraderTraitor with high confidence.
US agencies urge cryptocurrency platforms to block stolen funds
The FBI called on cryptocurrency exchanges, blockchain infrastructure operators, and other digital asset service providers to help prevent the stolen funds from moving further through the financial system.
The appeal specifically targeted THORNode operators, remote procedure call (RPC) node operators, instant exchanges, DeFi services, and blockchain analytics firms.
These organizations were urged to block transactions involving digital wallet addresses identified as being controlled by or closely connected to the North Korean hackers.
The FBI published an extensive list of cryptocurrency addresses associated with the theft, including wallets on the Ethereum, Bitcoin and Solana networks. The bureau said the addresses either currently hold or previously held assets stolen during the attack.
The alert reflects concerns that the hackers could exploit the decentralized nature of cryptocurrency transactions to obscure the origins of the stolen assets and move them beyond the reach of investigators.
Binance said Saturday that it had replenished approximately 90% of the stolen cryptocurrency and set aside about $6.34 billion in company funds to cover the losses. The exchange also said it had been working with blockchain partners to identify and freeze affected assets.
The company suspended withdrawals after the breach and said it was working the restore service on Sunday. Binance co-CEO Richard Teng described the breach as a complex attack involving a compromised laptop and malware designed to erase evidence of the intrusion.
The exchange has pledged to cover customers’ losses, drawing on its corporate treasury and financial reserves as it works to restore normal operations.
