Skip to main content
BitCurrent

Crypto markets, protocols and policy

FBI links $6 billion Binance theft to North Korea

The FBI attributes Binance’s October 29 theft of more than $6 billion to North Korea’s TraderTraitor, as agencies urge crypto firms to block laundering routes.

BitCurrent Newsroom2 min read

FBI links $6 billion Binance theft to North Korea

North Korea’s TraderTraitor group, previously linked to the Bybit hack, is accused by the FBI of stealing more than $6 billion in virtual assets from Binance, the world’s largest crypto exchange.

  • More than $6 billion: the FBI’s estimate of assets stolen.
  • October 29, 2026: the date of the Binance theft, according to the FBI.
  • $1.5 billion: the value of the Bybit theft AP says was linked to the same actors last year.

In its October 31 alert, the FBI attributed the attack to North Korea and named the activity TraderTraitor. The bureau said it had observed the stolen assets being converted primarily into Ether.

What does the FBI say happened to the stolen crypto?

The FBI, alongside the U.S. Secret Service and IRS Criminal Investigation, says the assets are being moved toward further laundering. It expects the attackers to use decentralised finance services and instant swaps.

The agencies urged crypto businesses, including exchanges and blockchain analytics firms, to block transactions connected to addresses identified in the alert. The FBI published a list of those addresses.

What has Binance said about customer losses?

Binance said it had enough of the same digital assets set aside to cover 90% of the missing funds and promised full reimbursement, The Associated Press reported. AP put the theft at $6.3 billion.

That commitment addresses customer reimbursement, but the recovery of the stolen assets remains open. The FBI’s alert describes laundering activity and asks firms to disrupt it; it does not say how much, if any, of the funds have been recovered.

How firm is the attribution?

The FBI directly assigns responsibility to North Korea and identifies TraderTraitor as the group involved. AP reported that President Donald Trump said investigators did not yet know whether North Korea was involved, leaving a public contradiction around the attribution.

Source material