Back

FBI Attributes $6 Billion Binance Theft to North Korea

lite News Desk 2 min read

North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance, according to an FBI alert dated October 31, 2026. The agency identified the activity as TraderTraitor and placed the theft on or around October 29.

Binance put its loss at approximately $6.3 billion in token assets, saying the compromise of its hot wallets occurred around 20:05 UTC on October 29. In Binance Research’s general definition, hot wallets use an internet connection to sign and transmit transactions, while cold wallets remain offline.

Withdrawals were temporarily suspended during security checks and remediation, according to Binance’s October 30 operational update. The company said deposits continued to be available, along with platform services unaffected by the incident.

By October 31, Binance said it had replenished approximately 90% of the affected assets, compared with roughly 80% at its preceding update. The company said its corporate treasury and Secure Asset Fund for Users would fund coverage of the incident’s losses.

The October 30 update put company funds reserved for that purpose at more than $6.34 billion. That total included $5 billion held in the token assets involved in the theft, which Binance said represented about 80% of the affected amount at the time. Separately, the company said approximately $3 billion had been frozen on-chain.

The investigation was still open as of October 30, Binance said. Its initial assessment included the possibility that a compromised laptop was involved, but subsequent investigative work identified other breach points. At that stage, the company said it had found no evidence of wallet private keys having leaked.

According to the FBI, observations made with IRS Criminal Investigation and the U.S. Secret Service showed TraderTraitor converting stolen holdings predominantly into Ethereum. The bureau said it expected additional attempts to launder the assets using decentralized-finance services and services offering instant swaps. That expectation was part of the agency’s assessment, rather than a report that those further attempts had occurred.

The three agencies also requested transaction blocking by businesses handling virtual assets and related private-sector services. Their request covered transactions involving addresses listed in the alert, as well as transactions derived from those addresses, which the FBI identified as being used by TraderTraitor actors for laundering the stolen assets. Exchanges, decentralized-finance services, blockchain analytics firms and node operators were among the businesses included in the request.

* This article is based on publicly available information at the time of writing.

More from Cybersecurity

  1. Drupal recommends updating Commerce Core to a fixed release and reviewing orders for inconsistencies.

  2. Apple says the reported exploitation was extremely sophisticated and involved selected targets using iOS versions earlier than iOS 27.

  3. The flaw affects Brotli data processed by Node.js’s zlib module, with crashes, memory disclosure or code execution possible for attacker-supplied input.

  4. A cyber incident impacted services in Neshoba County, with email and website disruptions reported, according to company updates.

  5. A cyberattack began on 13 October 2026, targeting over 100 Azerbaijani state domains, disrupting government online resources, according to CERT.