FBI links $6.3bn Binance theft to North Korea’s TraderTraitor

The FBI says North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or about October 29, identifying the activity as TraderTraitor. The attribution puts a government agency’s name to a theft that AP reports totalled $6.3 billion and took minutes. In its October 31 public notice, the FBI says it has observed the stolen assets being converted primarily into ether and is urging crypto firms to block transactions tied to listed addresses.

How does this compare with the previous record?

The Binance theft is more than four times the roughly $1.5 billion taken from Bybit in February 2025, which the FBI also attributed to TraderTraitor. That earlier hack had been the largest known crypto exchange theft; AP now describes the Binance incident as the biggest crypto heist in history. The comparison makes the scale clear, but it does not establish that the attacks used the same method: the FBI’s Binance notice identifies the group and traces asset movements, without explaining how the attackers gained access.

The FBI’s earlier Bybit alert described stolen funds being spread across thousands of addresses and multiple blockchains, with some converted to bitcoin and other virtual assets. In the Binance case, the agency says funds are moving primarily into ether and may next pass through decentralized finance services and instant swaps. Those are different reported stages in the laundering process, and the Binance notice does not say how much has been recovered or frozen.

What can exchanges and blockchain firms do now?

The FBI, alongside the U.S. Secret Service and IRS Criminal Investigation, is asking node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual-asset businesses to block transactions involving addresses linked to the theft. That response depends on firms acting on shared address information as stolen assets move between services. Public blockchains can make transfers traceable, but tracing alone does not return funds; the FBI’s request is aimed at disrupting the next conversions before the assets move further through laundering routes.

Binance has separately told AP it has enough of the same digital assets to cover 90% of the missing amount and has promised full customer reimbursement. That is a statement about the company’s capacity and commitment, not confirmation that the stolen funds have been recovered or customers have already been repaid. It also means the immediate customer-loss question is distinct from whether investigators and private firms can stop the attackers from converting the assets.

Which signals will show whether the response is working?

The next indicators are whether services block transactions connected to the addresses in the FBI notice, whether the movement into ether and onward swaps slows, and whether authorities or Binance report assets frozen or recovered. The FBI says it expects further laundering through DeFi and instant-swap services, so those routes are central to its warning. Binance’s reimbursement progress will also matter to customers, while the attribution and the size of the theft raise a separate question for the industry: whether coordination across exchanges and infrastructure can keep pace with transfers made in minutes.

Sources and documents

• October 31 public notice — fbi.gov
• Bybit alert — fbi.gov