FBI Attributes $6 Billion Binance Theft to North Korean Hackers
The FBI has attributed the theft of more than $6 billion in virtual assets from the cryptocurrency exchange Binance to North Korean malicious cyber activity. The theft took place on or about October 29, 2026, and the agency published its alert on October 31. The Verge later reported the total at $6.3 billion in crypto assets.
The FBI calls the actor behind the operation TraderTraitor. Binance has described the intrusion in its own incident notices. In an October 29 update, the exchange cited a suspected compromised engineer laptop as part of the incident. In a later announcement, Binance said its hot wallets were compromised at around 20:05 UTC on October 29. Hot wallets hold assets online to support withdrawals, which makes them the primary target in most exchange breaches. The timing suggests the attackers moved quickly once they had access.
According to the FBI alert, the agency, working with partners at the U.S. Secret Service and IRS Criminal Investigation, observed TraderTraitor actors converting the stolen assets primarily into Ether (ETH), the native token of the Ethereum network. The FBI expects the proceeds will be further laundered through decentralized finance (DeFi) protocols, which run lending and trading applications on blockchains without a company in charge, and through instant swap services, which exchange one asset for another with minimal identity checks. Both channels offer speed, which matters when an attacker is trying to get ahead of freezes.
Binance's response has centred on containment and reimbursement. The exchange said approximately $3 billion had been frozen on-chain following the incident. It said losses from the security incident would be covered by SAFU, its Secure Asset Fund for Users. In a later report, The Guardian reported Binance's statement that 90% of losses from the hack were covered. Binance also reopened customer withdrawals, which it had frozen in the immediate aftermath of the hack, as reported by The Verge.
The broader context here is the attack surface. A hot wallet compromise at this scale comes down to key management, signing workflows and access control, and an exchange's internal tooling is only as strong as the devices its engineers use. Binance's suspected laptop compromise points to the human and device layer rather than a flaw in a smart contract or a public blockchain. That distinction matters for any platform holding customer assets, because the controls that protect a multisig signing process differ from those that protect a developer workstation with privileged access.
In my view, the more durable lesson concerns the laundering path rather than the entry point. An exchange can freeze what it can see and what sits on a compliant venue, but the FBI's expectation that assets will move through DeFi and instant swaps means recovery depends on cooperation across chains, protocols and service providers that do not share a single operator. The reimbursement figure describes one exchange's balance sheet. The recovery figure, and how much of the $6.3 billion ultimately reaches the attackers, is still unsettled.
For practitioners, the more useful outcome is a set of concrete, documented facts: a date, a target, a named threat cluster, a suspected initial foothold and a published laundering pattern. Those details give security teams something to test against. Whatever the final tally, the attribution and the disclosed ETH conversion path will likely shape how exchanges, custodians and their insurers model threats from state-linked actors who target operational staff as well as code.
