The FBI has officially held North Korea responsible for orchestrating the largest cryptocurrency heist in history—stealing over $6 billion in virtual assets from the Binance exchange on October 29, 2026. This was revealed in a statement released by the agency's cyber branch on Saturday.
The federal agency has labeled this operation as "TraderTraitor," a term it uses for North Korean cyber activities focused on digital asset theft. The FBI collaborated with the U.S. Secret Service and the Internal Revenue Service's Criminal Investigation Division (IRS-CI) for this case.
According to blockchain intelligence firm TRM Labs, the attackers managed to transfer approximately $6.36 billion from Binance wallets across 10 blockchains in just 20 minutes. The stolen assets included Bitcoin, Ether, and stablecoins such as Tether and USD Coin.
Complex Attack on Binance Infrastructure
The attack initiated by compromising the equipment of a Binance operations development employee or contractor. The intruders escalated their privileges to access the transaction-signing infrastructure.
The most sophisticated element involved Binance's Ethereum hot wallet, known as "Binance 14." The attackers deployed an automated contract and exploited an Ethereum feature that temporarily delegates control of a wallet to a smart contract, completely emptying it.
Efforts to Launder Stolen Funds
The FBI noted that the perpetrators primarily converted the stolen funds into Ethereum with the intention of laundering them through decentralized finance protocols and instant exchange services. The agency, along with its partners, urged node operators, exchanges, blockchain analysis firms, and other virtual asset service providers to block transactions linked to the addresses used by TraderTraitor to launder the funds.
Binance estimated the impact at approximately $6.3 billion, stating it had reserved enough assets to cover 90% of the affected funds and committed to fully reimbursing its clients. Additionally, the platform contributed to freezing around $3 billion within the blockchains themselves.
North Korean Hacking History
This heist far surpasses the previous record set by the hack of the Bybit exchange in February 2025, which amounted to about $1.5 billion. TraderTraitor is connected to North Korea's Lazarus/APT38 group, known for other attacks such as the $620 million theft from Ronin Network in 2022 and over $300 million from DMM Bitcoin in 2024.
By the end of 2025, the cumulative total stolen by North Korean hackers in cryptocurrencies was estimated at $6.75 billion; the hit on Binance nearly doubles that figure in a single attack.
Diplomatic Tensions and Responses
The diplomatic context adds a significant twist. Just weeks before the attack, President Donald Trump had referred to North Korean leader Kim Jong-un as his "friend" and expressed interest in a summit before the end of the year.
When asked on October 30 if Pyongyang was behind the hack, Trump responded from the Oval Office, "We don't know. We're looking into it." The next day, following the FBI's attribution, he stated from Mar-a-Lago that he was "not concerned" and that the U.S. would speak with North Korea if their responsibility was confirmed.
Secretary of State Marco Rubio confirmed on Sunday that Trump remains open to talks with Pyongyang, although he noted no meeting is currently scheduled. Meanwhile, North Korea has not responded to U.S. diplomatic efforts and continues its offensive cyber operations to fund its weapons program and evade international sanctions.
Understanding the North Korean Crypto Heist
How did the North Korean hackers execute the Binance heist?
The hackers compromised the equipment of a Binance employee or contractor, escalated privileges, and accessed the transaction-signing infrastructure. They used an Ethereum feature to delegate wallet control to a smart contract, allowing them to empty the wallet.
What measures did Binance take in response to the theft?
Binance estimated a $6.3 billion impact but reserved enough assets to cover 90% of the affected funds. They committed to fully reimbursing customers and helped freeze approximately $3 billion within the blockchains.
What is the TraderTraitor operation?
TraderTraitor is the FBI's designation for North Korean cyber activities focused on stealing digital assets. It is linked to the Lazarus/APT38 group responsible for significant cryptocurrency thefts.