FBI links $6bn Binance theft to North Korea’s TraderTraitor

North Korea’s TraderTraitor hackers stole more than $6 billion in virtual assets from Binance on Oct. 29, the FBI said, identifying the group behind the exchange theft and warning that the funds are being laundered. The bureau said the attackers were converting assets primarily into ether.

How did the attackers move so much crypto so fast?

Binance said blockchain partners had frozen at least $3 billion of the $6.3 billion stolen, while the exchange believed attackers gained initial access by compromising an engineer’s laptop, Axios reported. Binance co-CEO Richard Teng said the hackers also used a mechanism that destroyed tools and traces during the attack.

Chainalysis told Axios the theft took as little as 20 minutes, while TRM Labs said the attackers began preparing 36 hours before it started. The FBI identifies the operation as TraderTraitor, the same group AP linked to the $1.5 billion Bybit theft in 2025.

Where are the stolen assets going?

TraderTraitor actors have converted the stolen assets primarily into ether, according to the FBI’s alert. The bureau expects further laundering through decentralized finance services and instant swap services.

The FBI said it published cryptocurrency addresses holding or previously holding assets from the theft. It urged blockchain infrastructure operators, exchanges, DeFi services and other virtual asset businesses to block transactions connected to those addresses.

What happens next in the recovery effort?

Investigators and blockchain firms are trying to stop the remaining funds from moving through laundering channels. Binance said it would fully reimburse customers, AP reported, after the exchange said it had reserves to cover 90% of the missing assets.

The FBI, the U.S. Secret Service and IRS Criminal Investigation are asking industry operators to block transactions tied to the listed addresses as they track the funds.

Source material

• Axios reported — axios.com
• FBI’s alert — fbi.gov