FBI Unmasks North Korea as Masterminds Behind Record-Breaking $6.3 Billion Binance Crypto Heist

The United States Federal Bureau of Investigation (FBI) has officially linked North Korea to the theft of over $6 billion in virtual assets from the cryptocurrency exchange Binance. In a public notice issued on October 31, the FBI identified the Democratic People's Republic of Korea (DPRK) as responsible for the attack, which occurred around October 29, 2026. The agency refers to this North Korean cyber operation as “TraderTraitor” and revealed that its investigators, in collaboration with the US Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI), have been actively tracking the movement of these stolen funds.

According to the FBI, the perpetrators are primarily converting the stolen cryptocurrency into Ethereum (ETH), with the intention of subsequently laundering these assets through various decentralized finance (DeFi) platforms and instant-swap services. The agency has cautioned that the suspected hackers are preparing to move the assets through multiple stages to obscure their origins and complicate recovery efforts. Consequently, the FBI, USSS, and IRS-CI have appealed to cryptocurrency companies and other virtual asset service providers, specifically mentioning THORNode operators, RPC node operators, instant exchanges, DeFi services, and blockchain analytics firms, to identify and block transactions involving wallet addresses associated with the operation. An extensive list of these addresses, spanning Ethereum, Bitcoin, and Solana networks, has been published by the FBI, described as being operated by or closely connected to North Korean TraderTraitor actors.

This formal attribution by US law enforcement follows earlier reports from blockchain analysis firms like TRM Labs and Chainalysis, which had previously linked the breach to North Korea. Researchers at these firms noted similarities between the Binance attack and prior cryptocurrency thefts attributed to Pyongyang, including a 2025 theft from Bybit, indicating a consistent modus operandi.

Meanwhile, Binance has been diligently working on its recovery efforts following the security incident. The exchange's initial investigation suggested that a compromised computer belonging to one of its engineers might have served as a possible entry point, potentially allowing an attacker to access a service container and submit unauthorized withdrawal transactions. Crucially, Binance has maintained that its investigation found no evidence of customers' wallet private keys being leaked, reassuring users about the safety of their core assets. The company had previously pledged to cover all losses incurred by users and has actively collaborated with industry partners and law enforcement to trace and freeze the stolen assets, successfully freezing approximately $3 billion worth of affected assets.

Binance commenced a phased restoration of withdrawal services on Sunday, November 1, 2026, after completing thorough security assessments and operational readiness checks. The resumption began with Bitcoin (BTC) withdrawals, followed by USDC, USDT, and Ethereum (ETH) on the Ethereum network, and USDC, USDT, and BNB on the BNB Smart Chain (BSC). The exchange explained that this phased approach prioritizes cryptocurrency assets based on user demand over the preceding week, ensuring security and stability before making individual networks and assets available. While deposits remained unaffected throughout the incident, users were cautioned about potential temporary delays or longer processing times during the initial rollout due to increased traffic.

In a significant update, Binance announced that it had replenished approximately 95 percent of the assets affected by the security breach, an increase from the 90 percent disclosed earlier. The company confirmed that it had fully backed customer balances in major cryptocurrencies including Bitcoin (BTC), Ethereum (ETH), Tether (USDT), BNB, Solana (SOL), USD Coin (USDC), XRP, USD1, RLUSD, and Zcash (ZEC). The remaining five percent consists of less liquid tokens that require more time to source in the necessary quantities through cryptocurrency market transactions and over-the-counter (OTC) channels. Binance reiterated its unwavering commitment to absorbing the financial impact of the stolen funds, ensuring that these losses would not be passed on to customers. To achieve this, the exchange deployed part of its Secure Asset Fund for Users (SAFU), reallocated a portion of its Futures Insurance Fund, and utilized funds from its corporate treasury, setting aside more than $6.34 billion to cover losses.

Binance continues its intensive collaboration with industry partners and law enforcement agencies to freeze assets, trace stolen funds, and support comprehensive recovery efforts. The exchange has also committed to publishing a detailed post-incident report once its investigation is fully complete, providing further insights into the breach. The FBI, for its part, remains dedicated to identifying, disrupting, and mitigating North Korea's cybercrime operations and virtual asset theft, underscoring the ongoing global effort to combat such illicit activities.