FBI blames North Korea for $6.3B Binance crypto theft

The FBI has officially attributed the theft of approximately $6.3 billion in digital assets from the cryptocurrency exchange Binance to North Korean state-sponsored hackers. The agency identified the malicious cyber activity as 'TraderTraitor,' a group also tracked under the names Lazarus Group, Jade Sleet, and APT38. The FBI stated that the theft occurred on or about October 29, 2026. This incident is confirmed as the largest cryptocurrency heist on record. Blockchain intelligence firms TRM Labs and Chainalysis had previously linked the theft to TraderTraitor before the FBI's official attribution.

Binance linked the breach to a compromised DevOps engineer's laptop. This compromise allowed attackers to access a service container and submit unauthorized withdrawal transactions. The attackers stole approximately $6.36 billion in cryptocurrency across ten blockchains. Most of the funds were transferred in just 20 minutes. The FBI observed TraderTraitor actors converting the stolen assets primarily into Ethereum. Binance froze customer withdrawals in the immediate aftermath of the hack and later reopened them.

The FBI, U.S. Secret Service, and IRS Criminal Investigation are asking virtual asset service providers to block transactions linked to addresses used by the hackers to launder stolen funds. The FBI published a list of 628 cryptocurrency addresses associated with the theft. This list includes 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address. North Korean hackers have been linked to numerous other crypto-theft attacks. These include the $387.5 million Bitget theft in September 2026, the $280 million Drift hack in April 2026, and the $1.5 billion Bybit heist in February 2025.

One tactic used by North Korean Lazarus hackers is 'Operation DreamJob,' where they impersonate recruiters to trick employees into installing malware. In the DMM Bitcoin attack, hackers impersonated a recruiter on LinkedIn and tricked an employee at the cryptocurrency wallet company Ginco into running malicious Python code disguised as a pre-employment test. The Bybit heist stemmed from a compromised Safe{Wallet} developer's computer, which let hackers access the wallet platform and manipulate a legitimate transaction. CertiK reported that North Korea-linked hackers stole about 60% of the value lost to crypto hacks in 2025. A CertiK report attributed more than $2 billion of an estimated $3.4 billion in 2025 crypto security losses to groups tied to North Korea. Between 2016 and early 2026, North Korea-linked actors stole an estimated $6.75 billion in cryptocurrency across 263 documented incidents.