FBI ties record Binance heist to North Korea's TraderTraitor

The FBI has formally attributed the 29 October 2026 Binance cryptocurrency heist to North Korean state-sponsored hackers, SecurityWeek reported on 2 November. The attackers emptied Binance hot wallets on multiple blockchains, moving most of the funds out within roughly 20 minutes; Binance estimates the impact at about $6.3 billion, the largest crypto theft on record.

In an alert released on 31 October, the FBI, together with the Secret Service and the IRS, linked the theft to the TraderTraitor group and named 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address that hold or held proceeds. It called on THORChain node operators, instant exchanges, DeFi services and blockchain analytics firms to refuse transactions tied to them. The FBI previously blamed the same group for the $1.5 billion Bybit hack in February 2025.

Binance co-CEO Richard Teng said later findings uncovered additional points of breach beyond a compromised laptop, and the exchange says about 95% of the stolen amount has been replaced with company funds. Elliptic puts the theft at $6.43 billion across 11 blockchains, with $2.85 billion frozen or seized on-chain, and describes laundering that runs around the clock, apparently automated.

Why it matters The speed of the theft and of the laundering leaves the industry little time to act on the published addresses. Attribution to a North Korean state-sponsored group also means that funds tied to these addresses carry state-actor risk for any exchange or service that receives them.