The FBI has formally confirmed that North Korean state-sponsored hackers carried out the record Binance crypto theft, taking more than $6bn in virtual assets from the exchange on 29 October. Investigators linked the intrusion to the malicious cyber campaign known as TraderTraitor, marking the largest cryptocurrency theft recorded to date.
Key points
- Federal investigators attributed the multi-billion-dollar breach of Binance to North Korean state cyber group TraderTraitor.
- Hackers compromised an engineer’s laptop to siphon assets across ten blockchains before laundering tokens through ether.
- The US government published 628 wallet addresses and called on crypto infrastructure providers to freeze transactions.
- Binance began phased withdrawals on Sunday after drawing on emergency reserves to cover 95 percent of lost assets.
Federal agencies attribute record attack
In a joint investigation, the FBI, the US Secret Service, and the Internal Revenue Service Criminal Investigation division identified North Korea as the perpetrator. The agencies published a formal security alert detailing the intrusion on Saturday.
The attribution confirms earlier findings from private tracking services. After initial reports tied the record intrusion to Pyongyang, blockchain intelligence companies TRM Labs and Chainalysis had linked the on-chain movements to the same operators.
TraderTraitor, also monitored by researchers under monikers such as Lazarus Group, Jade Sleet, and APT38, represents North Korea’s specialised financial hacking apparatus. The outfit has systematically targeted cryptocurrency exchanges, software firms, and decentralised protocols to generate revenue for the state.
Investigators observed the attackers converting the stolen cryptocurrency into ether shortly after the transfer. The bureau warned that this conversion represents only the opening phase of a wider effort to clean the stolen digital assets.
“It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages,” the FBI said in its alert.
How the hackers breached Binance
The theft unfolded at high speed on 29 October. Attackers moved roughly $6.36bn across ten distinct blockchains, transferring the bulk of the funds within a 20-minute window.
The initial breach occurred through a compromised laptop assigned to a Binance DevOps engineer. That machine gave the attackers access to a service container within the exchange’s internal architecture, allowing them to submit unauthorised withdrawal requests that bypassed standard operational limits.
Discrepancies remain regarding the precise financial total. Binance reported the losses at approximately $6.3bn, while research from blockchain analytics firm Elliptic estimated the haul at $6.43bn.
To interrupt the laundering pipeline, US law enforcement published a registry of 628 cryptocurrency addresses tied to the theft. The list comprises 608 Ethereum addresses, 19 Bitcoin addresses, and a single Solana address holding the stolen capital.
Federal officials urged THORNode operators, remote procedure call node providers, instant swap platforms, and analytics companies to blacklist these wallets immediately. The coordinated appeal aims to prevent the attackers from routing funds through decentralised bridges into fiat currencies.
A pattern of social engineering
The scale of the Binance theft dwarfs North Korea’s previous operations. According to Elliptic, actors tied to Pyongyang had stolen over $6.5bn in digital assets in recent years, including more than $1bn during the first ten months of 2026.
The FBI previously blamed the same group for the theft of $1.5bn from Bybit in February 2025. That incident also relied on compromising an engineer’s machine, when developers at Safe{Wallet} fell victim to a coordinated social engineering strike.
TraderTraitor has frequently used a playbook known as Operation DreamJob. Under this scheme, operatives pose as recruiters on social platforms to engage software developers, eventually tricking targets into running malicious scripts disguised as technical employment assessments.
That technique enabled the May 2024 theft of $308m from DMM Bitcoin, where an employee at cryptocurrency wallet company Ginco executed malicious Python code. In April 2026, the group spent six months meeting Drift contributors in person at global industry conferences before compromising their devices to take $280m.
Beyond remote compromises, the US Department of Justice recently indicted 14 individuals over a conspiracy that placed North Korean IT personnel within more than 70 domestic companies. These personnel routinely funneled wages and internal network access back to Pyongyang.
Binance response and reserve recovery
Binance reopened customer withdrawals in stages on Sunday between 06:00 and 09:00 UTC. The opening phase restored service for networks and tokens experiencing the highest transaction volume, while less active pairs remained paused for security reviews.
The exchange drew on multiple internal capital pools to cover the loss. Funding came from its Secure Asset Fund for Users, its futures insurance fund, and corporate treasury accounts, allocating more than $6.34bn to shield customer accounts.
“Binance will absorb the financial impact of the stolen funds, not our users,” the company wrote in an update to customers.
Binance stated it has covered 95 percent of the missing assets through existing reserves and direct purchases. The remaining five percent consists of less liquid tokens that require additional time to acquire across over-the-counter channels without causing severe market slippage.
Balancing customer accounts for major assets, including Bitcoin, ether, Solana, and dominant stablecoins, is complete. Binance plans to publish a complete zero-knowledge proof of reserves by Tuesday 3 November, allowing token holders to verify that all assets match customer account liabilities one-to-one.
