FBI Confirms North Korean Hackers Responsible for $6 Billion+ Binance Attack

The Federal Bureau of Investigation has confirmed that North Korean hackers stole more than $6 billion in virtual assets from Binance on or about October 29, 2026. The agency tracks the activity as TraderTraitor, linking the cryptocurrency theft to an operation previously blamed for major attacks against digital asset platforms.

In its official security alert, the FBI said investigators observed the attackers converting stolen funds primarily into Ethereum. The investigation involves the United States Secret Service and the Internal Revenue Service’s Criminal Investigation division, bringing together agencies focused on cybercrime, financial fraud, and illicit money flows.

Binance estimated the financial impact at approximately $6.3 billion. Its initial investigation suggested that a compromised laptop belonging to a DevOps engineer may have enabled unauthorized withdrawals. The company later identified additional breach points, meaning the full attack path remains under investigation rather than established as a single device compromise.

FBI Confirms North Korean Hackers

Cybersecurity News previously reported on the Binance cryptocurrency theft, citing TRM Labs findings that wallets across ten blockchains were drained, with most funds moved within roughly 20 minutes. Researchers also identified malicious sweeper contract activity targeting an Ethereum hot wallet, a wallet used for online transactions.

These findings describe how funds were removed, but they do not establish exactly how the attackers first entered Binance’s systems. The FBI alert does not identify an exploited vulnerability, a malware family, or a complete technical chain. Claims that a specific software flaw caused the breach therefore remain unsupported by that notice.

The FBI expects the stolen assets to move through decentralized finance, or DeFi, platforms and instant swap services during further laundering stages. These services allow digital assets to be exchanged, potentially creating additional transfers that investigators must follow. The observed Ethereum conversions are confirmed activity, while the next laundering steps remain the agency’s assessment.

Authorities are urging exchanges, blockchain analytics firms, DeFi providers, THORNode operators, and remote procedure call node operators to block transactions involving addresses used by the attackers. The request also covers transactions derived from those addresses, extending attention beyond the wallets that initially received stolen assets.

TraderTraitor has a documented history of cryptocurrency theft. The FBI previously attributed the approximately $1.5 billion Bybit hack of February 2025 to the same activity. Cybersecurity News’s Bybit attack investigation coverage described developer workstation compromise, cloud access, and changes to a wallet interface. Those findings provide background, not proof that Binance suffered the same attack chain.

According to reports, Binance said it had covered 95% of the stolen tokens and planned to restore withdrawals in phases on November 1. The remaining assets were less liquid and harder to source. Replacing customer assets should not be confused with recovering the funds held by the attackers.

Anyone with relevant information can contact an FBI field office or submit a report through the Internet Crime Complaint Center. IC3 collects cybercrime reports to support investigations and identify patterns. It also warns that it does not partner with private crypto recovery services, an important caution for victims approached with promises to recover stolen funds.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?