The United States Federal Bureau of Investigation (FBI) has blamed North Korea for the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance.
The FBI identified a North Korean-linked hacking operation known as TraderTraitor as responsible for the massive cryptocurrency theft, which occurred around October 29, 2026.
In a statement released on Saturday, October 31, the agency said its investigations had linked the operation to North Korea.
“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance,” the agency said.
The FBI added that the hackers had been converting the stolen assets, primarily into Ethereum (ETH), as part of efforts to conceal their origin.
According to the agency, the stolen funds are expected to be moved through decentralised finance (DeFi) platforms and instant cryptocurrency swap services to facilitate further laundering.
The FBI, working with the United States Secret Service (USSS) and Internal Revenue Service Criminal Investigation (IRS-CI), urged cryptocurrency companies and other private-sector organisations to block transactions connected to the identified wallet addresses.
It specifically called on blockchain infrastructure operators, cryptocurrency exchanges, DeFi platforms and other virtual asset service providers to help prevent the movement of the stolen funds.
Binance Moves to Cover Losses
The attack has raised fresh concerns about cryptocurrency security, particularly the ability of sophisticated hacking groups to target major digital asset platforms.
Binance, the world’s largest cryptocurrency exchange by daily trading volume, said it had taken steps to cover the financial impact of the incident.
The company disclosed that it had replenished about 90 per cent of the stolen assets, while promising to cover the remaining losses.
Binance co-chief executive Richard Teng said customers would not bear the financial consequences of the breach.
The exchange also began reopening customer withdrawals in phases after initially suspending them following the attack. The Guardian
TraderTraitor and North Korea’s Cyber Operations
TraderTraitor is believed to have links to the Lazarus Group, a hacking network widely associated with North Korean cyber operations.
The group has previously been linked to major cryptocurrency thefts and other cyberattacks targeting financial institutions and technology organisations.
The latest incident has renewed attention on North Korea’s alleged use of cybercrime to generate revenue amid extensive international sanctions against the country.
The FBI said its investigation was ongoing and urged relevant organisations to remain vigilant against transactions associated with the hackers.
The agency’s announcement provides an official attribution of the Binance theft to North Korea, although the movement and recovery of the stolen assets remain important parts of the investigation.
