Skip to main content
BitCurrent

Crypto markets, protocols and policy

FBI links $6bn Binance theft to North Korea

The FBI says North Korea stole more than $6 billion from Binance, naming TraderTraitor and tracing funds converted mainly into Ether for further laundering.

BitCurrent Newsroom2 min read

FBI links $6bn Binance theft to North Korea

Binance is the world’s largest cryptocurrency exchange; the FBI says North Korea stole more than $6 billion in virtual assets from it in an attack on or around October 29. The bureau attributed the theft to TraderTraitor, a North Korean hacking operation.

  • More than $6 billion in assets stolen, according to the FBI.
  • October 29, 2026: approximate date of the theft.
  • 628 addresses linked to the theft, according to BleepingComputer.

The FBI’s alert says investigators have observed the actors converting stolen assets primarily into Ether. The bureau, the US Secret Service and IRS Criminal Investigation are urging crypto services to block transactions tied to addresses associated with the laundering.

How are the stolen assets being moved?

The FBI says the actors are converting funds mainly into Ether, with further laundering expected through decentralised finance services and instant swaps. The agency published addresses it says are operated by or closely connected to TraderTraitor actors.

BleepingComputer’s report says the theft involved about $6.36 billion across ten blockchains, with most of the funds moved within 20 minutes. It reports Binance linked the breach to a compromised DevOps engineer’s laptop, which gave attackers access to a service container and enabled unauthorised withdrawals.

What remains unconfirmed?

The FBI has publicly attributed the theft to North Korea, but its alert does not describe how attackers gained access to Binance’s systems. The laptop and service-container account comes from Binance, as reported by BleepingComputer; the FBI alert does not confirm that mechanism.

North Korea has denied involvement, according to the Associated Press, calling the U.S. announcement a provocation. U.S. President Donald Trump also told reporters investigators did not yet know whether North Korea was responsible. The public record therefore contains an FBI attribution and a denial, while the technical path into Binance remains open.

Source material