FBI links $6.3 billion Binance crypto heist to North Korean hackers - BleepingComputer
The FBI has confirmed North Korean state-sponsored hackers known as TraderTraitor were behind the $6.3 billion cryptocurrency theft from Binance, the largest crypto heist on record.
The Federal Bureau of Investigation (FBI) officially confirmed that North Korean state-sponsored hackers, known as TraderTraitor, were responsible for stealing more than $6 billion in cryptocurrency from Binance on or around October 29, 2026. This attack marks the largest cryptocurrency heist in history.
The FBI's attribution follows similar conclusions from blockchain intelligence firms TRM Labs and Chainalysis. The agency has published a security alert detailing the connection to the North Korean hackers, who are also tracked as Lazarus Group, Jade Sleet, and APT38.
The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.
Attack Details
Binance previously linked the breach to a compromised DevOps engineer's laptop, which allowed attackers to access a service container and submit unauthorized withdrawal transactions. The hackers stole approximately $6.36 billion across ten blockchains, with most of the transferred in just 20 minutes.
The FBI has observed TraderTraitor converting stolen assets primarily into Ethereum (ETH), which it expects will be further laundered through decentralized finance (DeFi) platforms and instant cryptocurrency swap services.
The agency, along with the U.S. Secret Service and IRS Criminal Investigation, has published a list of 628 cryptocurrency addresses associated with the theft, including 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address.
North Korean Tactics
TraderTraitor has a long history of targeting cryptocurrency companies and their employees. The group frequently employs 'Operation DreamJob,' a campaign where they impersonate recruiters and approach software developers and cryptocurrency employees with fake job offers to trick them into installing malware.
Recent attacks follow this pattern, including the $387.5 million Bitget theft in September 2026, the $280 million Drift hack in April 2026, $1.5 billion Bybit heist in February 2025, and the $308 million DMM Bitcoin theft in May 2024.
In the DMM attack, hackers impersonated a LinkedIn recruiter and tricked an employee into running malicious Python code. The Bybit heist stemmed from a compromised Safe{Wallet} developer's computer, allowing access to manipulate transactions.
Binance Response
Binance has announced it will resume the first phase of withdrawals on November 1 between 06:00 and 09:00 UTC. The exchange has covered approximately 95% of the impacted amount, up from 90% in its previous update.
The remaining 5% consists of less-liquid tokens that Binance is continuing to purchase through market and over-the-counter channels. The exchange confirmed that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC balances are fully backed.
Related
