FBI Attributes Record $6.3 Billion Binance Hack to North Korea's TraderTraitor Group Amid Escalating Cyber Threats

The FBI has formally attributed the largest cryptocurrency theft in history—a heist exceeding $6.3 billion from Binance on October 29, 2026—to North Korea's TraderTraitor hacking operation. In an official cyber alert released October 31, the bureau, alongside the U.S. Secret Service and IRS Criminal Investigation, detailed how the actors converted stolen assets primarily into Ethereum and prepared further laundering through DeFi and instant swap services. The alert lists hundreds of implicated wallet addresses across Ethereum, Bitcoin, and Solana, urging virtual asset providers to block related transactions.

Blockchain analytics firms provided early attribution with high confidence. TRM Labs estimated the haul at $6.36 billion across 10 blockchains, mostly drained in about 20 minutes, and linked it directly to TraderTraitor based on on- and off-chain intelligence. Chainalysis corroborated this, noting commingling of Binance proceeds with funds from a prior Bitget exploit attributed to the same North Korean actors, marking the second major attribution after the $1.5 billion Bybit theft in February 2025.

Binance responded swiftly, confirming the breach likely originated from a compromised DevOps engineer's laptop and replenishing over 90% of losses with company funds (rising to ~95% by November 1), ensuring no customer impact. Withdrawals resumed in phases starting with Bitcoin. Stablecoin issuers like Tether and Circle froze billions in related assets, with roughly $2.7–2.8 billion immobilized on-chain.

This incident underscores North Korea's growing reliance on cybercrime to evade sanctions, with TraderTraitor evolving tactics including automated laundering and exploitation of Ethereum upgrades like EIP-7702. It raises broader concerns for global economic security, as such thefts fund state activities while eroding trust in crypto infrastructure and prompting calls for enhanced DeFi monitoring and international cooperation. President Trump downplayed immediate alarm, noting ongoing investigations, while no response has emerged from Pyongyang.