In brief
In a cyber‑alert released on 31 October 2026, the U.S. Federal Bureau of Investigation (FBI) named North Korea as the culprit behind a $6.36 billion theft from Binance. The attack—coded as TraderTraitor—steals coins and exchanges them for Ethereum and other assets. The FBI, working with the Secret Service and IRS, warned that the stolen funds could be laundered through decentralized finance platforms and requested exchanges to block affected wallet addresses.
On 31 October 2026 the U.S. Federal Bureau of Investigation issued a cyber‑alert identifying North Korea as the culprit behind a $6.36 billion theft of cryptocurrency from Binance, the world’s largest digital‑asset exchange. According to the alert, the theft occurred on or about 29 October 2026 and was carried out by a joint North Korean hacking team referred to by the agency as TraderTraitor, a moniker previously tied to several high‑profile crypto‑thefts.
The FBI’s message notes that the North Korean team siphoned funds from Binance and immediately converted the stolen assets into Ethereum, a major cryptocurrency. The alert also states that the operation has been in collaboration with the United States Secret Service and the Internal Revenue Service’s Criminal Investigation division, indicating a coordinated effort to trace and counter the laundering path.
The agency’s alert warns of a further attempt by the hackers to move the stolen funds through decentralized finance (DeFi) platforms and other exchange services that facilitate instant swaps of digital assets. In the text the FBI urges “crypto exchanges, blockchain operators, analytics firms and other virtual‑asset service providers” to block any transactions involving wallet addresses used by the culprits. This move follows a longstanding effort to curb state‑backed cyber‑crime that steals market values measured in billions of dollars.
In a paragraph of the alert, the FBI states,
The FBI is releasing information advising the Democratic People’s Republic of Korea was responsible for the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.
—FBI Cyber Alert, 31 October 2026
The alert follows a separate assessment by the U.S. blockchain intelligence firm TRM Labs, which earlier attributed the exact $6.36 billion theft to the TraderTraitor operation. In the same research, TRM Labs noted similarities between the Binance theft and an earlier hack on the cryptocurrency exchange Bybit, suggesting a repeat methodology that hints at sophisticated, state‑sponsored malware.
Other U.S. news outlets, including KMBC and WLWT, reported the FBI’s claim by 20 hours prior, confirming that “North Korea and TraderTraitor” were named as responsible for the hack. These reports also cited TRM Labs’ comparative analysis of Binance and Bybit incidents, emphasizing the broader trend of cross‑exchange attacks driven by North Korean cyber actors.
From a technical standpoint, the use of Ethereum as a “laundering vehicle” allows the hackers to merge stolen funds with legitimate Ethereum traffic, thereby obscuring the provenance of the assets. This strategy exploits the high liquidity of major cryptocurrencies, enabling near‑instant conversions that complicate forensic tracing for law‑enforcement agencies.
Exporting stolen BNB into Ethereum also positions the hackers to access a range of DeFi tools—such as automated market makers and liquidity pools—thus further diluting the clear lineage of the stolen money. The FBI’s caution against such platforms signals an awareness that the liquid nature of Ethereum could make illicit assets difficult to freeze or confiscate.
For the broader crypto industry, the alert serves as a reminder that state‑backed cyber‑crime continues to threaten market stability. The demand for exchanges to block ledger addresses tied to the operation underscores the need for stronger monitoring and faster collaboration between public agencies and private exchanges.
