The FBI formally attributed to North Korea the largest cryptocurrency theft in history: the theft of more than 6 billion dollars in virtual assets from the exchange Binance, carried out on October 29, 2026, according to an official statement released on Saturday by the agency's cyber division.
The federal agency identified the operation as “TraderTraitor,” its designation for North Korean malicious cyber activities specializing in digital asset theft, and acted in coordination with the U.S. Secret Service and the Criminal Investigation Division of the Internal Revenue Service (IRS-CI).
According to the blockchain intelligence firm TRM Labs, the attackers moved approximately $6.36 billion from Binance wallets across 10 blockchains in just 20 minutes. The stolen assets included bitcoin, ether, and stablecoins such as Tether and USD Coin.
The attack began with the involvement of a team member or contractor from Binance's operations development area, from which the intruders escalated privileges to gain access to the transaction signing infrastructure.
The most sophisticated component involved the Ethereum hot wallet known as "Binance 14": the attackers deployed an automated contract and exploited a feature of Ethereum that allows temporarily delegating control of a wallet to a smart contract, completely draining it.
The FBI observed that the perpetrators converted the stolen funds primarily into Ethereum, with plans to launder them through decentralized finance protocols and instant exchange services. The agency, along with its partners, urged node operators, exchanges, blockchain analytics firms, and other virtual asset service providers to block transactions linked to the addresses that TraderTraitor uses to launder the funds.
Binance estimated the impact to be approximately $6.3 billion, claimed to have set aside sufficient assets to cover 90% of the affected funds, and committed to full reimbursement of its customers. Additionally, the platform helped freeze nearly $3 billion within the blockchains themselves.
The theft far exceeds the previous record, the hack of the Bybit exchange in February 2025, which amounted to around 1.5 billion dollars. TraderTraitor is linked to the group Lazarus/APT38 from North Korea, responsible for previous attacks such as the theft of 620 million dollars from Ronin Network in 2022 and more than 300 million from DMM Bitcoin in 2024.
By the end of 2025, the total amount stolen by North Korean hackers in cryptocurrencies was estimated to be $6.75 billion; the attack on Binance nearly doubles that figure in a single incident.
The diplomatic context adds a notable paradox. Weeks before the attack, President Donald Trump had described North Korean leader Kim Jong-un as his "friend" and was expressing interest in a summit before the year's end.
When asked on October 30 if Pyongyang was behind the hacking, Trump responded from the Oval Office: "We don't know. We are investigating". The next day, following the FBI's attribution, he stated from Mar-a-Lago that he was "not concerned" and that the U.S. would talk to North Korea if their responsibility was confirmed.
The Secretary of State Marco Rubio confirmed this Sunday that Trump remains open to discussions with Pyongyang, although he specified that no meeting is scheduled, at a time when North Korea was not responding to American diplomatic efforts and continued its offensive cyber operations to finance its weapons program and evade international sanctions.
Related videos:
Filed under: