FBI links $6.7bn Binance crypto heist to North Korea

The US Federal Bureau of Investigation (FBI) has formally tied the attack on Binance, one of the world's largest cryptocurrency exchanges, to North Korea. According to the FBI, the theft of more than $6 billion in digital assets, which took place around 29 October 2026, was carried out by North Korea-linked cyber activity the bureau tracks as "TraderTraitor".

After the attack, Binance froze deposits and withdrawals, then confirmed that around $6.7 billion worth of various cryptocurrencies had been stolen. Some analysts had pointed the finger at TraderTraitor from the first days; the FBI's statement turns that assessment into an official attribution.

The FBI's statement and where the money is going

According to the FBI's announcement, TraderTraitor actors are converting the stolen assets mainly into Ethereum (ETH). The investigation is being run jointly by the FBI, the US Secret Service (USSS) and IRS-CI. The agencies say the assets are expected to be laundered next by swapping them through decentralized finance (DeFi) services and instant exchange platforms.

The FBI also published a long list of wallet addresses it believes hold the stolen funds. THORNode and RPC node operators, instant swap services, DeFi platforms, blockchain analytics firms and other virtual asset service providers were asked to block transactions involving those addresses or derived from them.

How the attack unfolded

According to Binance, the incident began with the compromise of a DevOps engineer's laptop. That access gave the attackers a way into a service container, from which the unauthorized withdrawals were sent. Some commentators have suggested the engineer may have fallen victim to a classic fake job-offer scam, while others believe a romance scam may have been involved.

Early reports say the attackers withdrew funds across 10 different chains, including Bitcoin, Ethereum, Solana, XRP and Arbitrum. On Ethereum, they are also said to have deployed a smart contract that automatically sweeps any new asset deposited into the account. Binance has resumed operations and covered most of its losses.

User assets were not affected

One relatively positive point is that the stolen money belonged to the exchange itself rather than to users. Crypto exchanges are required to keep separate wallets for their own assets and for customer assets. Binance also operates a security fund called SAFU (Secure Asset Fund for Users), designed to protect user assets during platform-wide emergencies.

Lazarus Group and the fake job campaigns

TraderTraitor is described as one of the sub-units of Lazarus Group, a broad cybercrime organization believed to work on behalf of North Korea. The group is alleged to steal money to fund the state apparatus and its weapons programs. North Korea has not responded to the accusations.

The cybersecurity community has long drawn attention to two major campaigns run by the group, Operation DreamJob and Contagious Interview. These target software developers, blockchain programmers and DevOps staff. The attackers set up fake companies, fake employees and attractive job offers, contact targets on LinkedIn and infect their computers with malware during interviews. In some cases they pose as Chinese, Vietnamese or Thai nationals and apply for open positions themselves, then use the role to steal sensitive data and money once hired.