FBI Confirms North Korean Hackers Stole Over $6 Billion From Binance in Massive Crypto Attack

The Federal Bureau of Investigation (FBI) has linked the theft of over $6 billion in virtual assets from Binance to North Korean hackers, labeling the operation as “TraderTraitor.”

In an advisory released on October 31, the FBI reported that the cryptocurrency exchange was targeted around October 29, 2026. This announcement marks an official attribution but does not disclose the technical entry point or how the compromise occurred.

Binance Hacked

Investigators from the FBI, the United States Secret Service, and the Internal Revenue Service Criminal Investigation have noted that the attackers have primarily converted the stolen assets into Ethereum.

Authorities anticipate that the subsequent laundering of these assets will involve decentralized finance platforms and instant swap services to facilitate further movement of the proceeds. While the conversion into Ethereum has been observed, details of downstream laundering activities remain speculative and unconfirmed.

The advisory emphasizes tracking stolen funds after the breach rather than explaining how Binance was compromised. It does not identify an exploited vulnerability, malware family, compromised signing mechanism, or initial access technique. Consequently, attributing this incident to phishing, stolen private keys, or a supply chain intrusion would go beyond what the FBI statement discloses.

Earlier reporting on TraderTraitor’s cloud and supply chain targeting describes operations involving social engineering, credential theft, and compromised development environments. That history provides context for the actor’s capabilities.

However, it does not establish that the same techniques enabled the Binance theft. Separating historical tradecraft from incident-specific evidence remains essential when assessing the attack.

The supplied advisory text calls on THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics companies, and other virtual asset service providers to block transactions associated with the stolen assets.

Its requested scope includes transactions involving identified attacker addresses and funds derived from those addresses, extending the response beyond monitoring the original receiving wallets.

Although the supplied material introduces a list of addresses associated with TraderTraitor, it includes no wallet addresses. This leaves the provided text without actionable address-level indicators for screening. It also contains no transaction hashes, malware hashes, affected software versions, or detailed forensic timeline. Readers should not interpret the attribution announcement as a complete technical incident report.

Related reporting on North Korean cryptocurrency attacks after the Bybit breach illustrates the continuing investigative challenge of following stolen assets through successive laundering stages. However, those findings concern earlier operations and should not be presented as Binance-specific evidence.

Individuals with relevant information can submit reports through the FBI’s Internet Crime Complaint Center. IC3 collects cybercrime complaints and may refer submissions to appropriate law enforcement agencies for investigation.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.