By Hamza Faisal
The FBI has formally blamed North Korea for the $6.3 billion theft from Binance, the largest cryptocurrency heist in history, naming the regime's TraderTraitor unit as the culprit and publishing wallet addresses it wants the crypto industry to block.
"The FBI is releasing information advising the Democratic People's Republic of Korea was responsible for the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026," the bureau said in a statement issued on October 31. It is the first official US government confirmation of what private investigators had suspected since the attack.
The theft drained roughly $6.3 billion from multiple Binance wallets in about 20 minutes on October 29, according to blockchain analytics firm TRM Labs. The scale dwarfs every previous crypto theft, and the FBI's attribution now puts a state actor's name on it.
Who TraderTraitor is
TraderTraitor is a North Korean state-backed hacking unit believed to sit inside the Lazarus Group, Pyongyang's most notorious cyber operation. The FBI previously blamed the same actors for the $1.5 billion theft from the Bybit exchange in February 2025, and the group has also been linked to a roughly $620 million crypto theft in 2022.
That record means North Korea now stands behind both the largest and the second-largest cryptocurrency heists ever recorded. Washington has long accused Pyongyang of using stolen cryptocurrency to fund its weapons programmes, and US officials treat TraderTraitor's campaigns as state-directed revenue operations rather than ordinary cybercrime.
The FBI said it reached its conclusion jointly with the US Secret Service and the criminal investigation division of the Internal Revenue Service, which have been tracing the stolen funds since the attack.
Where the money is going
Investigators have watched the thieves convert the stolen assets primarily into Ethereum, the FBI said, and expect the funds to be laundered further through decentralised finance platforms and instant swap services that convert one cryptocurrency into another with little scrutiny.
Alongside the attribution, the bureau released a list of Ethereum, Bitcoin and Solana wallet addresses it says were used or are believed to be in use by TraderTraitor members, urging exchanges, blockchain analytics firms and other businesses to block transactions linked to those addresses or originating from them.
The warning matters because speed is the launderers' main weapon. Once stolen coins pass through enough swaps and decentralised protocols, tracing them back to the heist becomes far harder — which is why the FBI moved to publish addresses while the trail is still warm.
What Binance has done since
Binance, the world's largest crypto exchange, has said it will absorb the full impact of the theft so customers lose nothing. It has set aside more than $6.34 billion in company funds — drawing on its corporate treasury, its Futures Insurance Fund and part of its $1 billion Secure Asset Fund for Users — and says about 90% of the stolen assets have already been replaced.
Withdrawals, suspended after the attack, were on track to reopen on November 1 subject to final security checks, and the exchange has promised a full proof-of-reserves accounting by November 3. Co-chief executive Richard Teng has described the breach as a "complex attack" without detailing how the attackers got in.
Private firms including TRM Labs and Chainalysis had already linked the attack to TraderTraitor before the FBI's announcement. The bureau's statement turns that private assessment into an official accusation — and a public blocklist the rest of the crypto industry is now being asked to enforce.
By Hamza Faisal
