The FBI has officially implicated North Korea in a massive cyberattack on Binance, a leading cryptocurrency exchange, resulting in the theft of over $6.3 billion in virtual assets. This incident, which took place around October 29, 2026, is recognized as the largest cryptocurrency heist to date.
According to the agency, a group of North Korean hackers known as TraderTraitor executed the heist, which they attempted to convert into Ether, the cryptocurrency of the Ethereum network. The FBI anticipates that these funds will undergo further laundering through decentralized finance (DeFi) services and instant exchanges, preparing them for subsequent stages of money laundering.
DeFi services operate on blockchain technology, enabling users to execute financial transactions without traditional intermediaries. In response to the attack, the FBI has published a list of approximately 500 Ethereum addresses currently being used for laundering the stolen assets and urged cryptocurrency platforms to block transactions associated with these addresses.
Detailed blockchain records indicate that a significant portion of the theft occurred in just 20 minutes on the evening of October 29. This theft is reportedly four times the amount previously stolen by TraderTraitor from the ByBit platform in February 2025, which totaled $1.5 billion at that time, marking it as the largest cryptocurrency theft until now.
Trump Questions North Korea’s Involvement
U.S. President Donald Trump expressed skepticism regarding North Korea’s involvement in the Binance heist. “I’m not worried. We’re about to find out more. We don’t know if it’s North Korea,” Trump stated to reporters at his Florida residence.
Understanding TraderTraitor
TraderTraitor is believed to be associated with the Lazarus group, which is linked to North Korean intelligence services. Lazarus gained notoriety in 2014 for hacking Sony Pictures Entertainment as retaliation for the satirical film “The Interview.” A 2020 report from the U.S. military indicated that North Korea’s cyber warfare unit, known as Office 121, employs around 6,000 personnel, operating from various countries, including Belarus, China, India, Malaysia, and Russia.
Recovery of Stolen Assets
In a statement on Saturday, Binance reported that approximately 90% of the stolen assets have been recovered, with the remaining 10% consisting of tokens that may be more difficult to acquire in necessary quantities due to lower liquidity. The exchange assured users that it would absorb the financial impact of the stolen funds and would not pass it on to them.
Binance also mentioned that efforts are underway to restore withdrawal services for users over the weekend, confirming their progress to reopen withdrawals by the previously announced date of November 1, 2026.
