FBI Blames North Korea for More Than $6 Billion Stolen From Binance in Largest Crypto Theft on Record
The FBI said Saturday that North Korea's TraderTraitor operation stole more than $6 billion in virtual assets from Binance on or about October 29 and is converting the funds primarily into Ethereum. Binance says about $3 billion was frozen and about 90 percent of the losses have been replenished.
WASHINGTON - The FBI has attributed the largest cryptocurrency theft on record to North Korea. In a cyber alert issued Saturday, October 31, the bureau said the Democratic People's Republic of Korea, through an operation it calls TraderTraitor, was responsible for the theft of more than $6 billion in virtual assets from Binance, the world's largest cryptocurrency exchange.
The theft took place on or about October 29, with about $6.36 billion moved across 10 blockchain networks, according to the accounts of the alert read this run. The FBI, working with the U.S. Secret Service and IRS Criminal Investigation, said it has observed TraderTraitor actors converting the stolen assets primarily into Ethereum, and expects further laundering through decentralized finance platforms and instant-swap services. The bureau published a list of wallet addresses linked to the theft and urged exchanges, node operators, DeFi platforms and other virtual asset service providers to block transactions involving them.
TraderTraitor is a label U.S. authorities have previously used for North Korean-linked cyber operations against cryptocurrency platforms, associated in reporting with the Lazarus Group and APT38 and with earlier thefts including the 2025 Bybit hack. Saturday's alert is the first official U.S. attribution of the Binance theft.
Binance estimated its losses at $6.3 billion, said approximately $3 billion of the stolen assets had been frozen onchain, and said it had replenished about 90 percent of the stolen assets by October 31 through market and over-the-counter purchases. The exchange set November 1 as its target for restarting withdrawals, subject to security checks. The FBI asked anyone with relevant information to contact a local FBI field office or report through its Internet Crime Complaint Center.
