Skip to the article
Web3 Hub

Markets, protocols and policy, reported

FBI links $6bn Binance theft to North Korea

The FBI attributed the Oct. 29 theft of more than $6 billion from Binance to North Korea’s TraderTraitor group and urged crypto firms to block linked funds.

By Web3 Hub Newsroom2 min read

FBI links $6bn Binance theft to North Korea

The FBI on Oct. 31 attributed the theft of more than $6 billion from Binance to North Korea’s TraderTraitor hacking group, calling the incident “malicious cyber activity.” The bureau said the assets were stolen on or about Oct. 29, making the case one of the largest recorded crypto thefts. The FBI’s alert names the group and lists wallet addresses linked to the stolen funds.

How did the attackers take the assets?

Elliptic’s analysis says Binance wallets across 11 blockchains were drained over several hours. Binance’s initial investigation suggested that a compromised DevOps engineer’s laptop may have given an attacker access to a service container and enabled unauthorized withdrawal transactions, according to Elliptic’s account of the breach.

Elliptic estimated the stolen crypto at $6.43 billion; Binance put the impact at about $6.3 billion. The theft exceeds the $1.46 billion taken from Bybit in February 2025, which Elliptic had identified as the previous record crypto heist.

Where are the stolen funds going?

The FBI said it observed TraderTraitor converting the assets primarily into Ether. It expects the group to use decentralised finance services and instant swaps to launder the funds further.

The FBI, alongside the US Secret Service and IRS Criminal Investigation, urged crypto exchanges, DeFi services, node operators and blockchain analytics firms to block transactions connected to the addresses it published. The alert also asks anyone with information to contact the FBI.

What happens next for Binance customers?

Binance said it would cover the financial impact of the theft. ABC News reported on Nov. 1 that the exchange had set aside enough of the stolen assets to cover 90% of the loss and had resumed withdrawals, beginning with Bitcoin.

The FBI expects laundering attempts to continue through DeFi and instant-swap services, and has asked crypto firms to block linked transactions as the funds move.

References