FBI Pins $6.3 Billion Binance Crypto Heist on North Korea’s TraderTraitor

The FBI has formally attributed the Binance crypto heist, the largest cryptocurrency theft on record, to North Korean state-sponsored hackers. In a security alert published on Saturday, the agency said the Democratic People’s Republic of Korea was responsible for the theft of more than $6 billion in virtual assets from the exchange on or about October 29, 2026.

The FBI named the group behind the attack as TraderTraitor, which is also tracked as Lazarus Group, Jade Sleet and APT38. The attribution follows earlier findings by the blockchain intelligence firms TRM Labs and Chainalysis, which had already linked the theft to the same group, according to BleepingComputer’s reporting.

How the Binance crypto heist unfolded

Binance has said the breach began with a compromised laptop belonging to a DevOps engineer. According to the exchange’s account, that gave the attackers access to a service container, from which they submitted unauthorised withdrawal transactions. About $6.36 billion was taken across ten blockchains, with most of it moved in roughly 20 minutes.

The FBI says it has watched TraderTraitor convert the stolen assets mainly into Ethereum. The agency expects the funds to be laundered further through decentralised finance platforms and instant crypto-swap services.

A call to freeze the money trail

The FBI, the U.S. Secret Service and IRS Criminal Investigation are asking exchanges, blockchain operators and other virtual asset service providers to block transactions tied to addresses the hackers used. The FBI published a list of 628 addresses linked to the theft: 608 Ethereum, 19 Bitcoin and one Solana. Such lists let platforms screen incoming deposits and refuse to process funds traced back to the attack.

A familiar pattern of attacks

The FBI’s alert places the Binance crypto heist in a long run of thefts attributed to North Korean actors. BleepingComputer lists the $387.5 million Bitget theft in September 2026, the $280 million Drift hack in April 2026, the $1.5 billion Bybit heist in February 2025 and the $308 million DMM Bitcoin theft in May 2024.

Several of those cases involved targeting the people who hold access to crypto infrastructure rather than the systems themselves. One long-running Lazarus tactic, known as Operation DreamJob, involves impersonating recruiters and sending developers and crypto employees fake job offers designed to get them to install malware. In the DMM Bitcoin case, an employee at the wallet company Ginco was reportedly tricked by a supposed recruiter on LinkedIn into running malicious Python code disguised as a pre-employment test.

The Bybit theft came through a compromised developer’s computer at Safe{Wallet}, which let attackers manipulate a legitimate transaction request. The Drift attack in April involved a six-month social engineering effort, in which people posing as a trading firm’s representatives met Drift contributors in person at several industry conferences. Devices are believed to have been compromised through a malicious code repository or a TestFlight application.

Binance says users won’t foot the bill

Binance said it plans to resume the first phase of withdrawals on November 1 between 06:00 and 09:00 UTC while it restores services. It says it has now covered about 95% of the affected amount, up from 90% in its previous update. The remaining 5% is in less-liquid tokens, which it is buying through market and over-the-counter channels.

The exchange said balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed, and that deposit services were not affected. “Binance will bear the financial impact of the stolen funds,” the company said. “These losses will not be passed on to users.”

The source material does not report any arrests or charges. The FBI’s statement is an attribution of responsibility to a state-linked hacking group, and the laundering of the stolen funds appears to be continuing.

Explore more on this topic with Vexel Search.