The Federal Bureau of Investigation has formally attributed the theft of more than $6 billion in cryptocurrency from Binance to a North Korean cyber operation tracked as TraderTraitor. The attack, which occurred on or about October 29, 2026, ranks as the largest known cryptocurrency heist and the biggest digital theft linked to state-sponsored actors.

Binance, the world’s largest cryptocurrency exchange by trading volume, reported losses estimated at approximately $6.3 billion in bitcoin and other digital assets. Funds were drained from hot wallets across multiple blockchains in a rapid operation lasting roughly 20 minutes in its main phase. The FBI, working with the United States Secret Service and the Internal Revenue Service Criminal Investigation division, stated that the perpetrators quickly began converting stolen assets primarily into Ethereum.

Details of the Attribution and Investigation

US officials linked the activity to the same network previously blamed for the roughly $1.5 billion theft from the Bybit exchange in February 2025. TraderTraitor is associated with the broader Lazarus Group, a North Korean state-sponsored cyber unit that US authorities have long connected to the Reconnaissance General Bureau. The group has a documented history of targeting financial institutions, cryptocurrency platforms, and other entities for revenue generation and intelligence purposes.

Investigators observed the attackers preparing to further launder the funds through decentralized finance platforms and instant swap services. Authorities have urged cryptocurrency exchanges, blockchain analytics firms, DeFi providers, and related operators to block transactions involving identified addresses and any derived funds.

Blockchain analysis firms had earlier pointed to North Korean involvement based on the speed of the withdrawals, wallet patterns, and similarities to prior incidents. Private sector assessments aligned with the official attribution issued two days after the breach.

Binance Response and Customer Protections

Binance confirmed it had set aside company funds sufficient to cover the vast majority of the stolen assets. The exchange reported replacing approximately 90 to 95 percent of the tokens, drawing on its Secure Asset Fund for Users, futures insurance resources, and corporate treasury. The remaining portion involves less liquid assets that may require additional time to source.

The company stated it would fully reimburse affected customers and planned to resume withdrawals in phases beginning November 1. Initial phases were set to include major tokens such as bitcoin, ether, BNB, Solana, XRP, and Dogecoin. Binance CEO Richard Teng described the incident as a complex attack involving multiple points of compromise rather than a single isolated breach. Early findings pointed to a compromised laptop belonging to a DevOps engineer, along with malware designed to erase evidence and the manipulation of transaction approval systems controlling an internet-connected hot wallet.

Binance founder Changpeng Zhao noted the company held significant liquid reserves, including SpaceX shares valued above $1 billion, in addition to its dedicated customer protection fund.

Background on the Group and Market Reaction

TraderTraitor has been described in prior US government advisories as employing spearphishing campaigns that pose as high-paying job offers to employees at cryptocurrency firms, particularly those in development and systems roles. Malicious applications disguised as trading or price-prediction tools have featured in earlier campaigns attributed to the network.

North Korea has previously rejected US accusations of state-directed cyber theft, characterizing them as attempts to damage its international standing. The latest incident adds to a series of high-value cryptocurrency thefts linked by Western governments to Pyongyang, including the 2022 Ronin bridge attack valued at around $620 million.

Cryptocurrency markets registered temporary declines following news of the breach. Bitcoin fell to a six-week low near $76,368 before stabilizing, while ether dropped more than 3 percent at one point. Shares of related public companies also declined in the immediate aftermath.

President Donald Trump, speaking at a Halloween event, said investigators were still gathering information and that responsibility had not been fully confirmed in his view at that moment, though he noted it remained possible the attribution would stand.

US agencies continue to track the movement of the stolen assets and have invited anyone with relevant information to contact FBI field offices or the Internet Crime Complaint Center. The rapid public attribution marks one of the faster official responses in recent major cryptocurrency theft cases linked to the same network.