The FBI has formally attributed the theft of more than $6 billion in cryptocurrency from Binance to TraderTraitor, a North Korean state-sponsored threat group. The agency said the incident took place around October 29, 2026, and involved approximately $6.7 billion in virtual assets.
Binance temporarily froze deposits and withdrawals after the attack. According to the exchange, an attacker compromised a DevOps engineer’s laptop and used access to a service container to submit unauthorized withdrawal transactions. The stolen assets reportedly came from Binance’s own funds rather than customer accounts, and the exchange later resumed operations and covered most of its losses.
Investigators said the attackers moved funds from 10 blockchains, including Bitcoin, Ethereum, Solana, XRP and Arbitrum. The FBI, working with the US Secret Service and IRS Criminal Investigation, observed the stolen assets being converted mainly into Ethereum. Authorities expect the funds to be moved through decentralized finance platforms and instant-swap services as part of further laundering efforts.
The FBI has published a list of cryptocurrency wallet addresses it believes contain the stolen assets. It is asking blockchain infrastructure operators, instant exchanges, DeFi services, analytics companies and other virtual asset providers to block transactions involving those addresses or funds derived from them.
TraderTraitor is associated with the wider Lazarus Group, which has been linked to North Korean campaigns targeting cryptocurrency businesses, software companies and professionals. Two of the group’s reported campaigns, Operation DreamJob and Contagious Interview, use fake companies, employees and job offers to target developers, blockchain programmers and DevOps workers. Malware may be introduced during interview processes, while attackers have also reportedly sought employment directly to gain access to sensitive information and funds.
North Korea has not commented on the allegations. The FBI’s attribution adds an official assessment to earlier analysis that had identified TraderTraitor as the likely group behind the Binance incident.
Sources: TechRadar.