The @FBI has attributed the theft of more than $6 billion from the @Binance exchange to North Korea, formally naming the state-linked hacking group TraderTraitor. The agency said North Korea
The @FBI has attributed the theft of more than $6 billion from the @Binance exchange to North Korea, formally naming the state-linked hacking group TraderTraitor. The agency said North Korea was responsible for stealing more than $6 billion in cryptocurrencies in the attack on Binance. The announcement came after days of speculation from private analysts about who was behind the breach.
@cz_binance, Binance's founder, publicly thanked the agencies involved in the response.
The FBI said the Democratic People's Republic of Korea (North Korea) was responsible for the theft of about $6.3 billion in digital assets from Binance on Thursday.In a news release on Saturday, it said it refers to this specific North Korean malicious cyber activity as "TraderTraitor", and that it has most recently observed the group converting stolen assets mostly into Ether ($ETH).
The FBI said it was working with partners at the US Secret Service (USSS) and the criminal investigation division of the Internal Revenue Service (IRS-CI).The agency expects the assets to be further laundered through DeFi and instant swap services.
The FBI's notice listed over 600 Ethereum addresses, just under 20 Bitcoin addresses and a single Solana address.It urged private sector entities, including THORNode operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms, to block transactions with addresses that TraderTraitor actors are using to launder the stolen assets.
Blockchain analytics firm Elliptic had earlier assessed North Korea as the likely culprit. Its analysis put the amount stolen at $6.43 billion on October 29, 2026, more than four times the $1.46 billion stolen from Bybit in 2025. The figure varies slightly between outlets, with reports citing roughly $6.3 billion to $6.4 billion.
Binance founder Changpeng Zhao thanked the FBI, Secret Service and IRS for help with "tracking, freezing, etc."He said a tweet was not enough to express appreciation, and that many crypto users may not realize the agencies deserve much of the credit for why bitcoin did not fall further.
On the financial impact, Binance said on Saturday it had replaced 90% of the amount stolen.It did so by using company money to buy new tokens.The exchange said it will absorb the financial impact of the stolen funds, not its users.
The political response has been mixed. Speaking at Mar-a-Lago on Saturday night, President Donald Trump suggested investigators were not yet certain North Korea was involved, saying "We don't know if it's North Korea."Earlier that day, he said his administration would "talk to North Korea about it."
The theft fits a longer pattern. Between 2016 and early 2026, North Korea-linked actors stole an estimated $6.75 billion in cryptocurrency across 263 documented incidents, according to CertiK, citing independent onchain researcher Taylor Monahan.The US government has linked such thefts to the funding of North Korea's weapons programs.
Sources:
