North Korea blamed for $6 billion Binance crypto theft, FBI names TraderTraitor
Synopsis
The FBI has formally pinned a $6 billion-plus cryptocurrency heist at Binance on North Korea's TraderTraitor operation — one of the largest crypto thefts in history. With hackers already converting funds to Ethereum and eyeing DeFi laundering routes, US agencies are racing to freeze assets before they vanish into the decentralised financial system.
Key Takeaways
The FBI formally attributed the theft of more than $6 billion in cryptocurrency from Binance to North Korea on 1 November 2026 .
The breach occurred on or about 29 October 2026 ; the North Korean operation is codenamed TraderTraitor .
Stolen assets are reportedly being converted into Ethereum and are expected to be laundered via DeFi platforms .
US blockchain firm TRM Labs had earlier pegged the theft at $6.36 billion , consistent with the FBI's assessment.
Binance has covered 90 per cent of losses, setting aside more than $6.34 billion ; users will bear no financial impact.
The FBI , US Secret Service , and IRS Criminal Investigation are jointly urging crypto platforms to block wallets tied to the hackers.
The US Federal Bureau of Investigation (FBI) has formally attributed the theft of more than $6 billion in cryptocurrency from Binance, the world's largest crypto exchange, to North Korea, identifying the operation as TraderTraitor. The agency issued a cyber alert on 1 November 2026 stating the hack occurred on or about 29 October 2026, marking one of the largest single crypto heists ever recorded.
What the FBI Said
In its cyber alert, the FBI stated: 'The FBI is releasing information advising the Democratic People's Republic of Korea was responsible for the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.' The agency identified the North Korean cyber operation under the codename TraderTraitor, a name previously linked to a string of cryptocurrency thefts carried out by Pyongyang-backed hackers.
The FBI said it had — in cooperation with the US Secret Service and the Internal Revenue Service's Criminal Investigation division — observed the hackers converting stolen assets primarily into Ethereum, a major digital currency, as part of an apparent laundering chain.
How the Laundering Is Unfolding
According to the FBI, the hackers are expected to continue laundering the stolen funds through decentralised finance (DeFi) platforms and cryptocurrency exchange services that allow rapid asset swaps. The three US agencies jointly urged cryptocurrency exchanges, blockchain operators, analytics firms, and other virtual asset service providers to block transactions involving digital wallet addresses tied to the North Korean operation.
Notably, US blockchain intelligence firm TRM Labs had earlier independently attributed an estimated $6.36 billion Binance breach to TraderTraitor — an assessment the FBI's alert now reinforces.
Binance's Response and Coverage
Binance has said it has covered approximately 90 per cent of losses stemming from the security breach, up from roughly 80 per cent previously. In an update posted on social media platform X, the exchange said it had set aside more than $6.34 billion in company funds to address breach-related losses. The company stressed that users will not bear any financial impact from the incident.
Binance also confirmed that major digital assets including Bitcoin (BTC) are currently backed on a one-to-one basis, offering reassurance to its global user base.
Broader Context and What Comes Next
The TraderTraitor group has been linked to a series of high-value crypto heists over recent years, with US officials and blockchain analysts consistently pointing to North Korea's state-sponsored hacking apparatus as a key source of illicit foreign-currency earnings for the sanctions-hit regime. This breach, if confirmed at the full $6.36 billion scale, would dwarf previous incidents attributed to the group.
Regulatory and law enforcement pressure on virtual asset service providers is expected to intensify in the coming weeks as investigators work to trace and freeze remaining funds before they are fully dispersed across the DeFi ecosystem.
Point of View
Systematically exploiting DeFi's regulatory blind spots to fund a sanctions-isolated regime. The fact that Binance has absorbed the loss privately, shielding users, raises a larger question about whether centralised exchanges are quietly becoming a buffer between state-level cyber-attacks and retail investors — a role they were never designed to play. Regulators in the US, EU, and India will need to decide how much of this burden can keep falling on the private sector before systemic risk accumulates.
NationPress
1 Nov 2026
Frequently Asked Questions
What is the TraderTraitor hack of Binance?
TraderTraitor is a North Korean state-linked cyber operation that the FBI says stole more than $6 billion in cryptocurrency from Binance on or about 29 October 2026. It is among the largest crypto heists ever attributed to a single actor.
How has Binance responded to the breach?
Binance has said it set aside more than $6.34 billion in company funds to cover losses and has now covered approximately 90 per cent of affected assets, up from 80 per cent earlier. The exchange confirmed that users will not bear any financial impact.
How is North Korea laundering the stolen cryptocurrency?
According to the FBI, the hackers have been converting stolen assets primarily into Ethereum and are expected to route funds through decentralised finance platforms and rapid-swap exchange services to obscure the trail.
Which US agencies are investigating the Binance hack?
The FBI is leading the investigation in coordination with the US Secret Service and the IRS Criminal Investigation division. All three agencies have urged crypto exchanges and blockchain firms to block wallet addresses linked to the North Korean operation.
How does this hack compare to previous North Korean crypto thefts?
TraderTraitor has been linked to multiple prior crypto heists, but the estimated $6.36 billion from Binance — as assessed by blockchain intelligence firm TRM Labs and now backed by the FBI — would be by far the largest single incident attributed to the group.
