FBI attributes $6bn-plus Binance theft to North Korea

Who stole more than $6 billion from Binance? The FBI says North Korea was responsible for a theft on or about Oct. 29, attributing the activity to the group it calls TraderTraitor. The scale makes it one of crypto’s largest reported thefts; the FBI’s alert puts the amount above $6 billion, while the Associated Press reports Binance said $6.3 billion was stolen.

What did the FBI attribute to TraderTraitor?

The FBI links the theft to North Korean cyber activity and says the stolen assets are being converted primarily into ether (ETH). That is the agency’s attribution; its alert does not describe how the attackers gained access to Binance or identify a specific technical exploit. The FBI says it expects further laundering through decentralised finance (DeFi) and instant swap services, which can move assets between tokens and platforms.

What action are authorities asking crypto services to take?

The FBI, the US Secret Service and IRS Criminal Investigation are urging crypto businesses and infrastructure providers to block transactions connected to addresses associated with the theft. The alert includes those addresses and names THORNode and RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers among those asked to act. The aim is to disrupt laundering as the funds move between assets and services.

The FBI’s alert ties this attribution to TraderTraitor’s earlier activity: the AP reports the group was also behind the $1.5 billion Bybit hack in 2025. Binance told the AP it had enough of the same digital assets set aside to cover 90% of the missing funds and promised customers full reimbursement. The next thing to watch is whether services block the listed addresses as the stolen assets move through ETH, DeFi and instant swaps.

References

• FBI’s alert — fbi.gov