FBI blames N. Korea’s TraderTraitor for Binance theft, urges crypto industry to block transactions

Federal law enforcement agencies have formally attributed the theft of more than $6.3 billion from the cryptocurrency exchange Binance to the North Korean hacking group TraderTraitor. The FBI and U.S. Secret Service issued statements over the weekend identifying the group and warning the crypto industry to block transactions linked to its addresses. The theft forced Binance to shut down for several days while it used its reserve funds to replace the stolen coins.

Binance initially claimed a compromised laptop belonging to an engineer was the source of the breach. However, a subsequent investigation uncovered "additional points of breach" and revealed that the attackers used a self-destruct mechanism to erase traces of their activity. CEO Richard Teng described the attack as complex and difficult to trace.

The Secret Service stated that it worked with cryptocurrency industry players and the Justice Department to "identify and freeze a significant portion of stolen cryptocurrency" within minutes of the attack. Blockchain security experts estimate that about $3 billion has been frozen so far. Despite these efforts, the sheer volume of the theft and the decentralized nature of the blockchain make full recovery unlikely.

The FBI provided a list of cryptocurrency addresses used by TraderTraitor to store the funds. The agency noted that the hackers were converting the stolen assets primarily into Ethereum and planned to use decentralized finance and instant swap services for further laundering. The Secret Service urged exchanges, decentralized finance companies, and other technical operators to "block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets."

Blockchain security firms Elliptic and Chainalysis reported that the laundering was conducted on autopilot. The hackers executed thousands of seemingly automated transactions, moving funds back and forth between the same wallets before routing them through mixers and other platforms. This speed and automation made it difficult for defenders to monitor or freeze the funds in real time.

Chainalysis senior investigator Pierce Vaughn noted that the laundering procedures were already in place, allowing the funds to be leveraged by DeFi platforms as soon as liquidity became available. Michael Barnhart, a nation-state threat researcher at DTEX, explained that TraderTraitor’s unique modus operandi is to immediately offload stolen funds to Chinese money launderers for a lump sum or percentage. This strategy shifts the risk of tracking and freezing entirely onto the Chinese criminal syndicates.

Former FBI deputy director Cynthia Kaiser said that approximately half of the stolen money has been moved so many times that it will make recovering more funds incredibly difficult. She emphasized the broader implications of such thefts, noting that North Korea uses stolen cryptocurrency to fund its weapons of mass destruction program. Kaiser recalled that some of the most complicated charts she ever received were from North Korean money movements following crypto heists.

Chainalysis published statistics highlighting the prolific nature of North Korean hacking campaigns. The country’s government is responsible for almost 90% of crypto hack losses in 2026, with the average reported loss per attack rising from $50 million in 2021 to $185 million in 2026. From 2021 through 2026, suspected North Korean hacks accounted for more than $13 billion in losses.

TraderTraitor has been a recurring target of FBI investigations and has been linked to several high-profile thefts. According to the FBI, the group was responsible for stealing $1.4 billion from the Dubai-based platform Bybit last year and nearly $300 million from KelpDAO in April 2026. Investigators tied the Binance incident to previous attacks, noting that funds from the platform were being commingled with cryptocurrency stolen from Bitget and other victims.

Binance reopened its site for deposits and withdrawals on Sunday morning. The platform’s controversial founder and former CEO, Changpeng Zhao, credited U.S. law enforcement agencies for helping to track and freeze the stolen funds, stating that their intervention prevented the price of Bitcoin from dropping significantly.