FBI Links $6.3 Billion Binance Hack to North Korean Cyber Operation - The National CIO Review

The FBI has confirmed that North Korean hackers were responsible for the $6.3 billion cryptocurrency theft from Binance on October 29, identifying the operation as TraderTraitor. This group has previously been linked to major cryptocurrency attacks, including the $1.5 billion Bybit theft in February 2025.

Previous Attacks

Federal investigators previously connected TraderTraitor to the February 2025 Bybit hack, during which hackers compromised a third-party wallet provider and altered a transaction approval interface to make unauthorized transfers appear legitimate. The Binance theft involved more than four times that amount, making it the group's largest publicly attributed cryptocurrency theft to date.

Developer Targets

North Korean hackers have previously used fake job offers and malicious applications to target developers and system administrators with access to sensitive company systems. During the Bybit attack, hackers reportedly posed as recruiters to compromise a developer's computer and gain access to internal infrastructure.

While investigators have not confirmed whether similar tactics were used against Binance, the exchange initially identified a potentially compromised employee laptop as a possible entry point.

Fund Tracking

The FBI reported that the hackers have been converting much of the stolen cryptocurrency into Ethereum, with further transfers expected through decentralized finance platforms and instant exchange services. Federal investigators are working with the Secret Service and IRS Criminal Investigation to track the money.

Company Response

Authorities have identified wallet addresses linked to the theft and are urging cryptocurrency exchanges to block related transactions. Binance said it had restored approximately 90% of the stolen funds by October 31, covering roughly $6 billion of the estimated $6.3 billion loss.

The exchange confirmed that major cryptocurrencies were fully backed and that it would cover the losses without passing the costs on to customers. Withdrawals began resuming in phases on November 1 as the company continued investigating the breach.