The FBI has formally attributed the theft of more than $6 billion in virtual assets from Binance to North Korea. In a security alert published on Saturday, the agency said the Democratic People’s Republic of Korea was responsible for the theft “on or about October 29, 2026,” and named the group behind it as TraderTraitor, which is also tracked as Jade Sleet, APT38 and Lazarus Group according to BleepingComputer, and as Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899 according to The Hacker News. The attribution follows earlier links to TraderTraitor from blockchain-analysis firms TRM Labs and Chainalysis, as reported by BleepingComputer.
The FBI, the U.S. Secret Service and IRS Criminal Investigation said they have seen the thieves converting the stolen assets mainly into Ethereum, and expect the money to be pushed through decentralized-finance (DeFi) services and instant swap services next. They asked exchanges, blockchain operators and other virtual asset providers to block transactions tied to the addresses used for laundering. According to BleepingComputer, the FBI’s list has 628 addresses: 608 Ethereum, 19 Bitcoin and one Solana.
Figures differ between outlets. BleepingComputer puts the theft at about $6.36 billion across ten blockchains, with most of it moved in 20 minutes. The Hacker News reports $6.43 billion across 11 blockchains, 82% of it on Ethereum and Bitcoin, and says $2.85 billion has been frozen on-chain by Tether, Circle, Ripple, Arbitrum and Optimism. Both outlets say the haul exceeds the $1.46 billion taken from Bybit in February 2025, making it the largest crypto theft on record. Binance’s own first count, in our earlier report, was about $6.3 billion in affected assets.
On the cause, Binance’s earlier preliminary statement pointed to a compromised DevOps engineer’s laptop that gave the attacker access to a service container, which was used to submit unauthorized withdrawals. BleepingComputer recalls that earlier North Korean thefts such as DMM Bitcoin and Bybit also began with a compromised employee or developer machine, often through fake recruiter approaches. The FBI alert as quoted by the outlets does not say how Binance’s laptop was compromised, so the link to that playbook is context from the outlets, not a finding about this case.
Binance told BleepingComputer it planned to resume the first phase of withdrawals on November 1 between 06:00 and 09:00 UTC. The Hacker News quotes Binance saying withdrawals are being restored progressively as security and readiness checks finish, and that deposit services remain open and were not affected.
Sources
- FBI alert: North Korea responsible for $6 billion Binance attack (the page returned a bot challenge to our fetch, so the FBI’s statements here are taken from the two outlets below)
- FBI links $6.3 billion Binance crypto heist to North Korean hackers, BleepingComputer
- FBI Links North Korea’s TraderTraitor to Record $6.43 Billion Binance Crypto Heist, The Hacker News
- Elliptic analysis of the Binance theft (linked from The Hacker News; not reviewed in full)