The US Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in cryptocurrency from Binance to North Korea, identifying the operation as TraderTraitor and warning that the stolen assets could be moved through decentralised finance (DeFi) platforms and cryptocurrency swapping services to conceal their origins.
In a cyber alert published on October 31, the FBI said North Korea was responsible for the theft of virtual assets from Binance on or around October 29, 2026. The agency also urged cryptocurrency exchanges, blockchain infrastructure operators and other digital asset service providers to block transactions connected to wallet addresses associated with the operation.
Binance previously estimated the impact of the breach at approximately $6.3 billion, making it one of the largest cryptocurrency thefts reported to date.
How North Korea carried out the Binance hack
Binance’s initial investigation suggested that the attack may have started with a compromised laptop belonging to a DevOps engineer. The attacker allegedly used access to an internal service container to submit unauthorised withdrawal transactions.
The exchange said it had found no evidence that wallet private keys were leaked. However, the full technical details of the attack have not yet been published.
Blockchain intelligence firm TRM Labs had previously attributed the incident with high confidence to TraderTraitor, a hacking operation associated with North Korea. The FBI’s announcement now provides an official US government attribution.
TraderTraitor is associated with North Korean cyber operations targeting cryptocurrency platforms and digital asset businesses. Such thefts are widely viewed by investigators as a source of funds for the country, which faces extensive international sanctions.
The FBI did not disclose every technical detail of how the attackers gained access to Binance’s systems in its public alert. Its announcement instead focused on identifying the operation, tracking the movement of stolen assets and disrupting efforts to launder them.
Hackers converting stolen funds into Ether
According to the FBI, investigators working with the US Secret Service and the Internal Revenue Service’s Criminal Investigation division observed TraderTraitor converting stolen assets primarily into Ether (ETH), the native cryptocurrency of the Ethereum network.
The agency warned that the attackers were expected to continue moving the assets through DeFi protocols and instant cryptocurrency swap services as part of further laundering efforts.
These services allow users to exchange one digital asset for another, sometimes across different blockchain networks. Although they serve legitimate purposes, they can also be used to complicate the tracing of stolen cryptocurrency.
Blockchain transactions are generally recorded on public ledgers, allowing investigators to follow the movement of funds between addresses. However, tracking assets does not automatically reveal the identity of the person controlling a wallet or guarantee that stolen funds can be recovered.
The FBI has published a list of cryptocurrency addresses that it says are holding or have held assets from the theft and are operated by, or closely connected to, TraderTraitor actors.
The agency urged operators of blockchain nodes, decentralised finance services, instant exchanges, analytics firms and other virtual asset service providers to block transactions involving those addresses or funds derived from them.
The request signals an effort to coordinate the response across the cryptocurrency ecosystem rather than relying on Binance alone to trace the stolen funds.
Binance moves to restore services and cover losses
The exchange said it had set aside more than $6.34 billion in company resources to cover losses and restore affected balances. Binance has also reported that it covered approximately 95% of the affected assets and began resuming withdrawals in phases on November 1.
Binance’s allocation of replacement assets is separate from the effort to recover the cryptocurrency originally stolen by the attackers. Replacing affected customer balances does not mean that the original funds have been recovered.
The exchange has said it is working with law enforcement and blockchain intelligence partners to trace the assets and identify opportunities to freeze or recover them.
The incident has renewed concerns about the security of cryptocurrency exchanges and the growing sophistication of attacks targeting their internal systems. It also highlights the importance of cooperation between exchanges, stablecoin issuers, blockchain operators and law enforcement when stolen funds move across multiple networks.
For now, the FBI’s warning places pressure on crypto service providers to identify and block transactions associated with the operation before the stolen assets can be moved further through the ecosystem. Whether those efforts will lead to substantial recovery of the original funds remains uncertain.
Read also: Binance Suffers $6.3B Hack as Crypto Market Sees $1.5B in Liquidations