FBI Blames North Korea Binance Hack
The Federal Bureau of Investigation has blamed North Korea for the North Korea Binance hack, the theft of more than $6 billion in virtual assets from the world’s largest cryptocurrency exchange. The bureau named TraderTraitor and said it had watched the group convert the stolen funds mainly into Ethereum.
The cyber alert, issued on Saturday, October 31, is the first official United States confirmation that Pyongyang was behind the attack. Private analysts had pointed to the same group days earlier.
How the FBI linked the North Korea Binance hack to TraderTraitor
“The FBI is releasing information advising the Democratic People’s Republic of Korea was responsible for the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026,” the bureau said in its alert.
Working with the Secret Service and IRS criminal investigators, the FBI said it had observed TraderTraitor actors converting stolen assets mainly into Ethereum. It warned the group is expected to launder the funds further through decentralised finance platforms and instant swap services.
The bureau published linked wallet addresses and asked exchanges and analytics firms to block linked transactions. Reuters reported the finding on Saturday.
How the theft unfolded on October 29
Funds began leaving Binance hot wallets, which stay connected to the internet, on the afternoon of October 29, Eastern Time. TRM Labs put the total at about $6.36 billion, most of it moving within roughly 20 minutes.
Binance co-chief executive Richard Teng called it a complex attack, involving a compromised laptop and software designed to delete evidence. Binance first pointed to a single compromised laptop, but later found more points of breach.
Feature Pakistan covered the confirmation of the $6.3 billion breach and the first reports of a suspected hack. The FBI attribution answers the next question: who carried out the attack.
What Binance has done for users
Binance says users will not bear the loss. Teng said the exchange has replenished 90 percent of the stolen assets and is committed to covering the rest. Binance set aside about $6.34 billion of company money, drawing on its Secure Asset Fund for Users, its Futures Insurance Fund and its corporate treasury.
Major balances are 100 percent backed, while the remaining shortfall sits in less liquid tokens. About $3 billion of the stolen assets has been frozen with help from token issuers: Tether froze about $1.6 billion, while Circle froze more than $800 million. Withdrawals were paused after the hack, and Binance says it is on track to reopen them on Sunday after security checks.
TraderTraitor and the record of North Korean crypto theft
TraderTraitor is the same unit the FBI previously blamed for the $1.5 billion theft from the Bybit exchange in February 2025. The FBI has also blamed North Korean hackers for a theft of about $620 million in 2022. At $6.3 billion, the Binance theft is more than four times the Bybit hack and the largest crypto theft on record. Analysts also linked TraderTraitor to last month’s Bitget hack.
What it means for readers in Pakistan
The case matters in Pakistan because Binance has a growing presence here. ProPakistani reported that Binance received a no-objection certificate to begin local registration last year, putting Pakistani users among those affected by the withdrawal pause.
Frequently asked questions
What did the FBI say about the Binance hack?
The FBI said North Korea was responsible for the theft of more than $6 billion from Binance on or about October 29, 2026, and named TraderTraitor in a cyber alert on October 31.
How much was stolen from Binance?
Binance put the impact at around $6.3 billion, while TRM Labs estimated about $6.36 billion moved, mostly within 20 minutes. About $3 billion has been frozen.
Will Binance users lose money?
Binance says no. It has replenished 90 percent of the stolen assets from its own funds and is committed to covering the rest, with major balances already 100 percent backed.
Who is TraderTraitor?
TraderTraitor is a North Korean state-backed unit linked to the Lazarus Group. The FBI previously blamed it for the $1.5 billion Bybit theft in February 2025, and analysts linked it to last month’s Bitget hack.
