The FBI has officially attributed the largest cryptocurrency theft in history to North Korea. In a cyber alert released October 31, 2026, the bureau stated that the Democratic People’s Republic of Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or about October 29. The agency labeled the operation “TraderTraitor,” the same designation previously tied to other major North Korean crypto thefts, including the $1.5 billion Bybit hack earlier in 2025.
Attackers drained Binance hot wallets across roughly ten blockchains in a coordinated strike that began around 20:05 UTC. Most of the funds left in about twenty minutes. Blockchain analytics firms put the total near $6.3 billion to $6.36 billion, with Ethereum accounting for the largest share (roughly $3.8 billion) and Bitcoin contributing about 18,270 BTC. Additional assets moved on the XRP Ledger, Tron, Solana, Arbitrum, Avalanche, and others. Analysts described the incident as nearly four times the size of the Bybit heist and one of the largest single financial thefts of any kind.
Binance’s early investigation pointed to a compromised DevOps engineer’s laptop that gave the attackers access to a service container, allowing them to submit unauthorized withdrawal transactions. The exchange said it found no evidence of private key theft. On Ethereum, the attackers used an EIP-7702 delegation to turn a major hot wallet into a controlled sweeper after submitting a batch of pre-signed authorizations. Preparation had begun at least 36 hours earlier, with funding through Tornado Cash and rehearsals on test wallets. Private firms TRM Labs and Chainalysis had already linked the attack to TraderTraitor with high confidence before the FBI’s public statement.
Within hours of the drain, Tether, Circle, and other issuers froze more than $2.7 billion in stablecoins. Roughly $3 billion was eventually locked or seized, while the remainder—mostly ETH, BTC, and other unfreezable assets—remained under attacker control and began moving through DeFi platforms and swap services. The FBI, working with the U.S. Secret Service and IRS Criminal Investigation, observed the stolen assets being converted primarily into Ethereum and urged exchanges, node operators, and DeFi services to block hundreds of listed addresses.
Binance halted withdrawals repeatedly stated that user funds remained safe and committed to covering every loss from company resources. Co-CEO Yi He said the company would absorb the financial impact and that the stolen amount represented only a small percentage of total user assets and public reserves. The exchange reserved more than $6.34 billion in corporate funds, including portions of its SAFU reserve, and reported coverage rising from about 80 percent to roughly 95 percent. Withdrawals began resuming in phases on November 1, starting with Bitcoin and expanding to Ethereum, BNB Chain, and other major networks. Founder Changpeng Zhao publicly affirmed that users would be made whole.
President Trump declined to endorse the North Korea attribution. When asked on October 30 whether North Korean hackers were responsible, he said, “We don’t know. We’re looking at that.” The following day at Mar-a-Lago, after the FBI alert, he added that he was “not concerned,” that officials were still learning the details, and “We don’t know if it’s North Korea, but if it is, we’ll talk to North Korea about it.” The comments arrived against the backdrop of his earlier summits with Kim Jong Un and his 2025 pardon of Zhao.
North Korea’s cyber units have long treated cryptocurrency theft as a revenue source for the regime’s weapons programs. TraderTraitor, tracked by U.S. authorities since at least 2022, specializes in compromising developer and operations environments before launching rapid, multi-chain drains. This single incident is assessed by some analysts as nearly doubling the total cryptoassets previously attributed to the regime in recent tallies. Binance continues recovery and security work while promising full user reimbursement; the FBI’s alert remains the clearest official U.S. government statement linking the heist to Pyongyang.
