FBI Blames North Korea For $6.3 Billion Binance Crypto Hack, Says Stolen Assets Being Converted Into Ethereum

The Federal Bureau of Investigation (FBI) has attributed the recent theft of $6.3 billion from Binance, the largest cryptocurrency exchange globally, to North Korean hackers. The incident, which occurred on October 29, 2026, is now recognized as the most significant cryptocurrency heist to date.

In an official statement, the FBI linked the attack to a group identified as "TraderTraitor," which was also responsible for a $1.5 billion hack of Bybit in the previous year. The FBI described this event as part of "malicious cyber activity" orchestrated by North Korean actors.

The FBI, in collaboration with the United States Secret Service (USSS) and the Internal Revenue Service's Criminal Investigation Division (IRS-CI), has monitored the actions of the TraderTraitor group as they convert stolen funds primarily into Ethereum (ETH). It is anticipated that these assets will undergo further laundering through decentralized finance (DeFi) platforms and instant exchange services to obscure their origins.

In light of these developments, the FBI has urged private sector stakeholders, including operators of THORNode, RPC nodes, instant exchanges, DeFi services, and blockchain analytics firms, to block transactions linked to the addresses associated with the TraderTraitor group. A list of these addresses has been made available for reference.

The FBI's call to action emphasizes the importance of preventing the laundering of these stolen assets. The agency has shared specific addresses for Ethereum, Bitcoin, and Solana that are believed to be involved in holding or processing the stolen funds, which are operated by or connected to the TraderTraitor group.

Ari Redbord, a cryptocurrency expert and chief policy officer at TRM Labs, commented on the situation, stating that he anticipates the hackers will fragment the stolen assets and attempt to launder them through smaller exchanges to evade detection. He described the scenario as akin to a bank robbery executed at the speed of the Internet, while also noting that authorities can track and trace these funds in real time to facilitate investigations and recovery efforts. “It’s just this cat and mouse game,” he remarked.

The theft from Binance, which took place on Thursday, has raised alarms in the cryptocurrency community, with experts pointing to the distinctive traits of a North Korean cyber operation. In response to the incident, Binance announced that it has sufficient reserves in the same cryptocurrencies that were stolen to cover approximately 90% of the missing assets. The company has assured its customers that they will be fully reimbursed for their losses.

This incident underscores the growing concerns surrounding cybersecurity in the cryptocurrency sector, particularly as state-sponsored hacking becomes more prevalent. As investigations continue, the FBI and its partners remain vigilant in their efforts to thwart further laundering attempts and to hold those responsible accountable.