FBI Pins $6.3bn Binance Heist on North Korea's TraderTraitor
The FBI says North Korean hackers stole more than $6bn from Binance. It published 628 crypto addresses and asked firms to block funds linked to them.
The FBI has put a name to the biggest crypto theft on record. It blames North Korea for the Binance attack and wants other firms to help block the money.
The exchange says it has covered most of the loss
Binance told BleepingComputer it was preparing to restart the first phase of withdrawals on November 1, between 06:00 and 09:00 UTC. About 95% of the affected amount is now covered, up from 90% in the previous update.
The rest is in less-liquid tokens, which the exchange keeps buying on the market and over the counter. Deposits are unaffected, and Binance says balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed.
The company also says it will bear the financial impact, and users will not pay for the losses.
628 addresses to watch
The FBI listed 628 addresses tied to the theft: 608 on Ethereum, 19 on Bitcoin and one on Solana.
Together with the US Secret Service and IRS Criminal Investigation, it asks exchanges, blockchain operators and similar firms to stop transfers involving addresses the hackers used for laundering.
Laundering route
The agency has seen TraderTraitor swap the loot mostly into Ethereum. It expects further laundering via decentralized finance platforms and instant swap services.
The haul was about $6.36 billion across ten blockchains. Most of it left within 20 minutes.
Binance had earlier tied the breach to a compromised laptop of a DevOps engineer. That let the attackers reach a service container and send unauthorized withdrawal transactions.
Who is behind it
TRM Labs and Chainalysis had already pointed at TraderTraitor before the FBI did. The group is also tracked as Lazarus Group, Jade Sleet and APT38.
The alert came out on Saturday. In it the FBI said North Korea was responsible for taking more than $6 billion in virtual assets from the exchange on or about October 29, 2026.
Earlier cases
North Korean hackers have been linked to the $387.5 million Bitget theft in September 2026, the $280 million Drift hack in April 2026, the $1.5 billion Bybit heist in February 2025 and the $308 million DMM Bitcoin theft in May 2024.
The Drift attack came after a six-month social engineering effort. People presenting themselves as a trading firm met Drift contributors at several industry conferences. Devices are believed to have been compromised through a malicious code repository or a TestFlight application.
In the DMM Bitcoin case, a fake recruiter on LinkedIn persuaded an employee of the wallet firm Ginco to run Python code posing as a pre-employment test. Operation DreamJob, a long-running Lazarus campaign, relies on fake job offers sent to developers and crypto staff.
Our view
An official attribution matters mostly for what comes next: the 628 addresses give exchanges something concrete to screen against. How much of the stolen money can still be frozen depends on whether service providers act on the request quickly, since the FBI expects laundering through swap services. The pattern of past cases suggests the weak point is people with privileged access rather than the blockchains themselves.
Source: BleepingComputer