North Korea Masterminded $6 Billion Binance Crypto Heist, FBI Warns
The FBI identifies North Korea's 'TraderTraitor' operation behind a massive $6.36 billion cryptocurrency heist from Binance.
In a staggering blow to the digital asset world, the Federal Bureau of Investigation (FBI) has revealed that North Korea is responsible for the North Korea Binance crypto theft, which saw over USD 6 billion in virtual assets vanish from the cryptocurrency exchange. The agency has sounded a global alarm, warning that the stolen funds are being aggressively laundered to hide their origins.
Operation 'TraderTraitor' Uncovered
The FBI, collaborating with the US Secret Service (USSS) and the Internal Revenue Service's Criminal Investigation division (IRS-CI), has labeled this sophisticated cyberattack as "TraderTraitor." According to a cyber alert issued on October 31, the breach occurred around October 29, 2026.
The scale of the theft is immense. Approximately USD 6.36 billion in digital assets were siphoned across 10 different blockchain networks. The security breach came to light on October 30, following the massive movement of funds from wallets controlled by Binance the previous day.
The Laundering Strategy
The FBI warns that the attackers are not simply holding the assets but are actively converting them, primarily into Ethereum (ETH). To mask the trail of the stolen money, the agency believes the actors are utilizing:
- Decentralised finance (DeFi) platforms.
- Instant-swap services.
- Complex movements across multiple blockchain networks.
Urgent Call to Action for Crypto Providers
To prevent the stolen funds from being cashed out, the FBI has urged a wide array of industry players to take immediate action. The agency has called upon cryptocurrency exchanges, THORNode and RPC node operators, DeFi platforms, instant exchanges, and blockchain analytics firms to block any transactions linked to specific wallet addresses.
The FBI has officially published a list of cryptocurrency addresses that currently hold, or have previously held, assets tied to this heist, demanding that virtual asset service providers prevent any transactions originating from these accounts.
A Pattern of State-Sponsored Cybercrime
This is not an isolated incident. The "TraderTraitor" label has been used by US authorities previously to track North Korean cyber operations. The FBI has specifically linked this activity to the notorious Lazarus Group and APT38.
The regime's history of targeting crypto platforms is extensive:
- Bybit Heist: In February 2025, the FBI attributed a USD 1.5 billion theft from Bybit to the same North Korean actors.
- 2023 Attacks: Affiliated actors were linked to thefts involving Alphapo, CoinsPaid, and Atomic Wallet.
The FBI emphasized that North Korea systematically uses cybercrime and the theft of virtual assets as a primary method to generate revenue for its regime.
Binance's Response
Following the discovery of the breach, Binance acknowledged a potential security issue. As a precautionary measure, the exchange temporarily suspended withdrawals across several of its networks while conducting an internal investigation into the loss.
The FBI is now seeking public assistance and has asked anyone with information regarding these thefts to contact their local FBI field office or submit a report through the Internet Crime Complaint Center.