The FBI has blamed North Korean hackers for the theft of more than $6 billion in cryptocurrency from Binance, identifying the state-linked group TraderTraitor as responsible for the attack. The attribution follows an investigation into one of the largest cryptocurrency thefts ever reported.
The breach was disclosed in late October 2026 after attackers transferred digital assets from the cryptocurrency exchange. Binance estimated the losses at approximately $6.3 billion, while subsequent reporting placed the stolen amount at around $6.43 billion.
In its announcement on October 31, the FBI identified TraderTraitor as the group behind the operation. The hacking collective is also tracked under several other names, including Jade Sleet, Slow Pisces and UNC4899. It has previously been linked to attacks targeting cryptocurrency companies and their employees.
The FBI said investigators observed the stolen cryptocurrency being converted primarily into Ethereum. Authorities expect the attackers to continue moving the assets through decentralized finance platforms and instant cryptocurrency exchange services to obscure their origin.
The investigation involves the FBI, the US Secret Service, and the Internal Revenue Service Criminal Investigation division. These agencies are tracking the movement of stolen funds and working to identify opportunities to disrupt further laundering.
Blockchain security researchers have also been monitoring the stolen assets. According to Elliptic, approximately $2.85 billion had been frozen across several blockchain networks, with assistance from organizations including Tether, Circle, Ripple, Arbitrum and Optimism.
The incident follows the February 2025 attack against cryptocurrency exchange Bybit, which resulted in approximately $1.5 billion in losses. US authorities previously attributed that theft to TraderTraitor, connecting the group to two exceptionally large cryptocurrency breaches.
Binance has been working to compensate affected customers and recover assets following the attack. The exchange reported that it had covered approximately 90% of the losses by November 1.
North Korea has rejected the FBI’s attribution. In a statement reported on November 3, Kim Yo Jong, sister of North Korean leader Kim Jong Un, accused Washington of making politically motivated allegations and denied the country’s involvement in the Binance theft.