- Input
- 2026-11-01 08:51:49
- Updated
- 2026-11-01 08:51:49
According to a publicly released FBI statement, law enforcement authorities underscored North Korea’s responsibility, saying, “We are informing the public that the Democratic People’s Republic of Korea (North Korea) was behind the theft of at least $6 billion in cryptocurrency from Binance.”
Binance previously said that digital assets worth $6.3 billion had been withdrawn without authorization in an attack that involved both hacking an engineer’s laptop and exploiting a flaw in its transaction approval system. It was the largest loss from a single hack in the history of the digital-asset industry. The FBI has been conducting a joint investigation with the U.S. Secret Service (USSS) and the IRS Criminal Investigation Division since shortly after the incident occurred on the 29th.
The theory that North Korea was behind the incident has circulated since it happened, but this is the first time the U.S. government has officially confirmed it. Blockchain analytics firms TRM Labs and Chainalysis named TraderTraitor as the group behind the incident shortly after it occurred.
TraderTraitor is also the group the FBI named as being behind the Bybit cryptocurrency exchange hack in February last year, when about $1.5 billion worth of assets was taken. TRM Labs estimated that the losses in this attack were about four times those in the Bybit incident.
The FBI said, “We have detected signs that TraderTraitor operatives are converting the stolen assets mainly into Ether (ETH).” The FBI expects the laundering to continue as the assets are moved into other digital assets through decentralized finance (DeFi) and instant-exchange services.
The FBI also released a list of Ethereum, Bitcoin (BTC) and Solana (SOL) wallet addresses that the operatives appear to have used or are using. The FBI stressed, “We urge you to block transactions associated with or originating from addresses that TraderTraitor operatives are using to launder stolen assets.”
The FBI said it “remains committed to protecting the digital-asset community by identifying, mitigating and deterring North Korea’s illicit cybercrime and digital-asset theft activities,” and also called for relevant tips.
Efforts to recover the losses are also continuing. According to U.S. media reports, Binance has frozen about $3 billion in stolen assets in cooperation with other exchanges and others.
Binance says it has set aside at least $6.34 billion in company funds to cover the stolen amount and that user assets are safe. TRM Labs said most of the attack took place across 10 blockchains in about 20 minutes.
[email protected] Seung-hyun Ahn Reporter
