FBI attributes $6.43 billion Binance theft to North Korea's TraderTraitor

The U.S. Federal Bureau of Investigation, along with the U.S. Secret Service and IRS Criminal Investigation, officially attributed a record $6.43 billion cryptocurrency theft from Binance to TraderTraitor, a North Korean state-sponsored hacking group, on October 31, 2026. The theft occurred on October 29, 2026, from the world's largest cryptocurrency exchange by trading volume, making it the largest known cryptocurrency heist in history.

Investigators determined that attackers exploited a compromised software engineer's laptop to gain initial access to Binance systems. The hackers then manipulated the exchange's transaction approval systems and used malware capable of deleting activity traces to move approximately $6.43 billion in digital assets from Binance's "hot wallet"—internet-connected storage used for daily operations—within approximately 20 minutes. The stolen assets included Bitcoin, Ethereum, stablecoins (USDT and USDC), Solana, XRP, Dogecoin, and other tokens across 11 blockchains, with 82% on Ethereum and Bitcoin.

Binance announced it had recovered approximately 95% of stolen assets by November 1, 2026, using company funds to purchase replacement tokens. The exchange set aside $6.34 billion in company reserves and committed to fully reimbursing customers. Phased withdrawals resumed on November 1, beginning with liquid tokens; the remaining 5% of less liquid tokens required additional time to source. Stablecoin issuers Tether and Circle froze approximately $15.7 billion and $800 million in related assets respectively, representing an unprecedented coordinated response. Blockchain entities including Ripple, Arbitrum, and Optimism also assisted in freezing assets, with $2.85 billion frozen on-chain in total.

Blockchain analysis firms including TRM Labs, Chainalysis, and Elliptic identified similarities between the attack methods and previous North Korea-linked cryptocurrency heists, including a $1.46 billion theft from Bybit in February 2025, also attributed to TraderTraitor. The FBI observed the attackers converting stolen assets primarily into Ethereum and expected them to attempt further laundering through decentralized finance platforms and instant swap services. The FBI urged cryptocurrency exchanges, blockchain analytics firms, and industry participants to block transactions associated with identified attacker addresses.

U.S. President Donald Trump stated that investigators were still examining the North Korea connection, saying "we don't know if it's North Korea," despite the FBI's official attribution. The incident sparked immediate price declines across major cryptocurrencies—Bitcoin fell nearly 5%, Ethereum nearly 6%, and BNB approximately 10%. Experts described the theft as exposing vulnerabilities in centralized cryptocurrency exchanges and contradictions between blockchain's decentralization ideals and practical implementation, raising questions about cryptocurrency's viability as mainstream financial infrastructure.