Key Takeaways
- • The FBI attributed the theft of more than $6 billion in cryptocurrency from Binance to North Korea's TraderTraitor hacking operation, calling it the largest cryptocurrency theft in history.
- • TRM Labs estimated approximately $6.36 billion was transferred from Binance wallets across 10 blockchain networks during the October 29 attack, with most assets moved in roughly 20 minutes.
- • The FBI, working with the US Secret Service and IRS Criminal Investigation division, urged exchanges, DeFi services, and analytics firms to block transactions tied to the identified wallet addresses.
- • Binance said it replenished about 90% of the stolen assets and set aside roughly $6.34 billion in company funds to cover losses, pledging to cover customer losses.
- • Stolen funds were being converted primarily into Ethereum, with agencies warning of further laundering through DeFi platforms and instant exchange services.
Summary
The FBI has accused North Korea of stealing more than $6 billion in cryptocurrency from Binance in a cyberattack carried out on October 29, 2026, according to a statement released on Saturday, November 1, as reported by The Jerusalem Post. The bureau identified the perpetrators as the Democratic People's Republic of Korea (DPRK) through a hacking operation known as TraderTraitor. The attack is believed to be the largest cryptocurrency theft in history, surpassing previous cyberattacks against digital asset exchanges.
In its official cybersecurity alert, the FBI said investigators, working alongside the US Secret Service and the Internal Revenue Service's Criminal Investigation division, had observed TraderTraitor operatives converting stolen assets primarily into Ethereum (ETH). The agencies warned that the assets could undergo further laundering through decentralized finance (DeFi) platforms and instant cryptocurrency exchange services, which could complicate tracing and recovery efforts.
Blockchain intelligence firm TRM Labs estimated that approximately $6.36 billion was transferred from Binance wallets across 10 blockchain networks, with most assets moved in roughly 20 minutes. The firm attributed the operation to TraderTraitor with high confidence.
The FBI urged cryptocurrency exchanges, blockchain infrastructure operators, and other digital asset service providers to block transactions involving wallet addresses controlled by or closely connected to the hackers. The appeal specifically targeted THORNode operators, remote procedure call (RPC) node operators, instant exchanges, DeFi services, and blockchain analytics firms. The bureau published an extensive list of addresses on the Ethereum, Bitcoin and Solana networks that either currently hold or previously held stolen assets.
Binance said on Saturday that it had replenished approximately 90% of the stolen cryptocurrency and set aside about $6.34 billion in company funds to cover the losses. The exchange suspended withdrawals after the breach and said it was working to restore service on Sunday. Co-CEO Richard Teng described the incident as a complex attack involving a compromised laptop and malware designed to erase evidence of the intrusion. Binance has pledged to cover customers' losses from its corporate treasury and financial reserves and is working with blockchain partners to identify and freeze affected assets.
In its official cybersecurity alert, the FBI said investigators, working alongside the US Secret Service and the Internal Revenue Service's Criminal Investigation division, had observed TraderTraitor operatives converting stolen assets primarily into Ethereum (ETH). The agencies warned that the assets could undergo further laundering through decentralized finance (DeFi) platforms and instant cryptocurrency exchange services, which could complicate tracing and recovery efforts.
Blockchain intelligence firm TRM Labs estimated that approximately $6.36 billion was transferred from Binance wallets across 10 blockchain networks, with most assets moved in roughly 20 minutes. The firm attributed the operation to TraderTraitor with high confidence.
The FBI urged cryptocurrency exchanges, blockchain infrastructure operators, and other digital asset service providers to block transactions involving wallet addresses controlled by or closely connected to the hackers. The appeal specifically targeted THORNode operators, remote procedure call (RPC) node operators, instant exchanges, DeFi services, and blockchain analytics firms. The bureau published an extensive list of addresses on the Ethereum, Bitcoin and Solana networks that either currently hold or previously held stolen assets.
Binance said on Saturday that it had replenished approximately 90% of the stolen cryptocurrency and set aside about $6.34 billion in company funds to cover the losses. The exchange suspended withdrawals after the breach and said it was working to restore service on Sunday. Co-CEO Richard Teng described the incident as a complex attack involving a compromised laptop and malware designed to erase evidence of the intrusion. Binance has pledged to cover customers' losses from its corporate treasury and financial reserves and is working with blockchain partners to identify and freeze affected assets.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.