The FBI has attributed the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance to a North Korean group known as TraderTraitor. The agency says the theft occurred on or about October 29, 2026. The Secret Service and IRS Criminal Investigation are assisting with the investigation.
Stolen Funds Movement
According to the FBI, TraderTraitor actors are converting the stolen assets primarily into Ethereum. Investigators expect the group to route the funds through DeFi platforms and instant swap services as part of a broader money laundering operation.
The FBI, Secret Service, and IRS Criminal Investigation have issued a public notice to private sector entities, including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and virtual asset service providers. The agencies are requesting these entities block transactions with addresses connected to TraderTraitor and are providing a full list of addresses associated with the North Korean actors.
Binance Response and Withdrawal Recovery
Binance moved quickly to cover the losses using $6.34 billion from its own funds. The exchange fully backed major assets including Bitcoin and Ethereum, and acquired less liquid tokens during the process. Binance is absorbing all costs related to the incident, meaning users are not bearing the financial burden.
Withdrawals began resuming in phases on November 1, with support for assets and networks including BTC, ETH, USDT, USDC, BNB, XRP, and additional tokens. Binance plans to complete a full proof of reserves by November 3.
Law Enforcement Action
The FBI has published a list of addresses holding or previously holding stolen assets and is encouraging anyone with relevant information to contact their local FBI field office or report through the Internet Crime Complaint Center at ic3.gov. The agency stated it remains committed to disrupting North Korea's illicit cybercrime and asset theft activities.
