FBI links record $6bn Binance theft to North Korea

The FBI said North Korea was behind the theft of more than $6 billion in virtual assets from Binance, a record crypto heist that it linked to the TraderTraitor group. In an Oct. 31 advisory, the bureau said the theft occurred on or about Oct. 29 and urged crypto firms and infrastructure operators to block transactions tied to listed addresses.

The scale is more than four times the roughly $1.5 billion taken from Bybit in February 2025, which the FBI also attributed to TraderTraitor. The Associated Press reported that Binance put the theft at $6.3 billion and said it had enough of the same digital assets set aside to cover 90% of the loss, with customers promised full reimbursement. Those figures describe different parts of the event: the FBI’s attribution and minimum estimate, and Binance’s reported impact and response.

What does the FBI say happened to the stolen assets?

The FBI said its investigators, working with the U.S. Secret Service and IRS Criminal Investigation, observed the group converting stolen assets primarily into Ethereum. The agency expects further laundering through decentralized finance services and instant swap services, which can exchange one digital asset for another.

The advisory names TraderTraitor as the North Korean cyber activity responsible. The AP reported that the same actors were linked to the earlier Bybit theft. That attribution connects the Binance incident to a known pattern of attacks on crypto businesses, but the FBI advisory does not describe the method used to gain access to Binance or identify a specific vulnerability. The published account therefore establishes the alleged perpetrators and the movement of funds, while leaving the entry point unconfirmed.

Can crypto firms stop the funds moving?

The FBI, Secret Service and IRS-CI called on node operators, exchanges, DeFi services, analytics firms and other virtual asset providers to block transactions involving addresses connected to the laundering effort. The FBI published a list of addresses it said were operated by, or closely connected to, TraderTraitor actors.

That request makes the response depend partly on businesses and infrastructure operators that can identify and refuse transactions. The AP quoted TRM Labs policy chief Ari Redbord describing the countermeasure as tracking and tracing funds in real time to support investigations and possible seizures. But the FBI’s warning also says the assets are expected to move through DeFi and instant swaps, making continued monitoring and coordination relevant as the attackers change addresses and routes.

Binance’s reported reserve coverage and reimbursement promise reduce the immediate risk that customers bear the full loss, but they do not recover the stolen assets or establish how the breach occurred. The incident also exceeds the previous Bybit record by several billion dollars, raising the stakes for both exchange safeguards and cross-industry tracing.

What should readers watch next?

The next signals are whether Binance completes customer reimbursement and publishes further details about the incident, whether authorities or industry firms freeze or recover funds, and whether the assets continue moving through the addresses and services identified by the FBI. The agency’s attribution is a significant step; the public record will become clearer as those investigations and the exchange’s recovery work progress.

Sources and documents

• Oct. 31 advisory — fbi.gov