The FBI has attributed the theft of more than $6 billion in digital assets from Binance, the largest cryptocurrency exchange globally, to hackers linked to North Korea. The breach, which struck the platform on October 29, 2026, disrupted Binance’s operations.
In a statement issued Saturday, two days after the incident, the agency said North Korea — formally the Democratic People’s Republic of Korea — was responsible for the virtual-asset theft. The reported amount taken from Binance was about $6.3 billion.
Quick facts
- The cyberattack occurred on or around October 29, 2026.
- The FBI identified the operation as “TraderTraitor,” a campaign associated with North Korean actors.
- Investigators said stolen funds were being converted largely into Ethereum.
- The agency expects further laundering through DeFi services, instant-swap providers and other channels.
- Binance said it had reserves sufficient to absorb the losses and protect customers.
The FBI said its investigation, conducted with the US Secret Service and the Internal Revenue Service Criminal Investigation division, had tracked the movement of the stolen assets. It said TraderTraitor operatives were primarily exchanging the funds into Ethereum.
“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum,” the agency said.
Authorities warned that the hackers were likely to continue disguising the funds’ origin by using decentralised-finance platforms and instant exchange services. The assets could then be routed through further money-laundering mechanisms, the FBI said.
The bureau called on people worldwide to share information that could help the investigation. It said it remains focused on safeguarding the digital-asset sector by detecting, limiting and disrupting North Korean cybercrime and cryptocurrency theft networks.
The FBI also released wallet addresses on the Ethereum, Bitcoin and Solana networks that it said currently hold, or previously held, assets taken in the Binance breach. The wallets are controlled by, or are closely tied to, North Korean TraderTraitor operators, it said.
Binance said it had adequate funds reserved to cover the damage from the attack. The exchange told users that customer holdings remained secure and that clients would not bear financial losses resulting from the incident.
