The FBI has officially confirmed that hackers backed by North Korea orchestrated a theft exceeding $6 billion in cryptocurrency from Binance around October 29, 2026. Dubbed “TraderTraitor,” the group has previously been tied to major digital asset platform hacks.
How the Heist Unfolded
Investigators believe the bulk of the stolen funds were converted into Ethereum. The breach sparked a multi-agency effort involving the FBI, the U.S. Secret Service, and IRS’s Criminal Investigation division. Binance estimates the total loss at about $6.3 billion. Early findings suggested that a DevOps engineer’s laptop may have been used to enable unauthorized withdrawals, though additional breach points were later identified—suggesting a more complex attack than a single-device compromise.
Path of the Stolen Funds & Response
Research revealed that wallets across ten blockchains were drained, with most movement happening within roughly 20 minutes. Malicious sweeper contracts were used to siphon assets from an Ethereum hot wallet. Still, the FBI has not confirmed which vulnerability or malware facilitated the initial breach. Speculative claims about a specific software flaw remain unsubstantiated.
Authorities anticipate that the laundered funds will transit through decentralized finance (DeFi) platforms and instant swap services—mechanisms that can obscure ownership and flow of assets. While Ethereum conversions are confirmed, later laundering stages are under assessment. Exchanges, blockchain analytics firms, DeFi providers, operators of THORNode networks, and RPC node operators have been urged to block transactions linked to the attackers’ wallet addresses, including derived ones.
TraderTraitor’s Track Record & Binance’s Recovery Plan
TraderTraitor has previously been held responsible for the February 2025 hack of Bybit, which involved $1.5 billion in stolen crypto. That incident featured compromises to developer workstations, cloud infrastructure breaches, and altered wallet interfaces. Although those results shed light on potential tactics, there is no definitive evidence that Binance was attacked the same way.
Binance has committed to covering 95% of the stolen tokens and aims to restore user withdrawals in phases beginning November 1. The remaining assets are reportedly less liquid and tougher to reclaim. It’s important to distinguish between offsetting losses for customers and recovering the stolen funds held by the perpetrators.
The FBI encourages anyone with relevant information to engage with their local field office or report through the Internet Crime Complaint Center (IC3). The bureau also warned against working with private crypto recovery services, emphasizing that IC3 doesn’t partner with such operations.
Analysis: This breach highlights the persistent threat posed by state-backed cybercriminal groups and the growing risk in centralized crypto exchanges. The scale and speed of the theft emphasize vulnerabilities in hot wallet security and the importance of multi-layered defenses. As DeFi becomes a common laundering route, cross-industry collaboration will be vital. Watch for tighter regulation, more aggressive blockchain monitoring, and potential sanctions or action against services facilitating money flows tied to such attacks.
