FBI attributes record Binance theft to North Korea
The FBI says North Korea stole more than $6 billion from Binance on Oct. 29, naming TraderTraitor and urging crypto firms to block laundering-linked transfers.
The Aeterna Sol Editors
More than $6 billion in virtual assets was stolen from Binance on or about Oct. 29, the FBI says. The bureau’s attribution to North Korea makes this a record crypto theft linked to a state-backed hacking group, and puts the focus on how quickly the funds can be laundered.
In its Oct. 31 cyber alert, the FBI named the North Korean operation TraderTraitor and said it was working with the U.S. Secret Service and IRS Criminal Investigation. The alert asks companies across the crypto industry to block transactions connected to addresses used to move the stolen assets.
How did the money leave Binance?
Blockchain intelligence firm TRM Labs estimates that an attacker moved about $6.36 billion from Binance wallets across 10 blockchains, with most transfers occurring in roughly 20 minutes. TRM says the theft began at about 20:05 UTC on Oct. 29.
TRM’s analysis says the Ethereum portion involved EIP-7702, a feature that lets an externally owned account temporarily delegate certain actions to a smart contract. The attacker used pre-signed authorizations to turn a Binance hot wallet—a wallet connected to the internet and used to process transactions—into a wallet it could sweep.
On nine other networks, TRM says Binance wallets sent funds to attacker-controlled addresses through ordinary signed transfers. The firm assesses that this pattern points to a compromise of Binance’s hot-wallet signing infrastructure. The FBI’s alert confirms its attribution and laundering concerns but does not describe how the intruder gained access.
What does the FBI say will happen to the stolen crypto?
The FBI says it has observed TraderTraitor converting the assets primarily into ether, Ethereum’s native token. The bureau expects the group to move funds through decentralized finance services and instant swap platforms as it attempts to launder them.
Decentralized finance, or DeFi, refers to financial services run through blockchain-based software rather than a traditional intermediary. Instant swaps let users exchange one crypto asset for another, which can make tracing the path of stolen funds more difficult.
The alert identifies blockchain addresses the agencies say are operated by, or closely connected to, TraderTraitor. It urges private-sector firms to:
- Check the FBI’s published addresses against transactions they process or monitor.
- Block transactions involving those addresses, including funds derived from them.
- Watch for further movement into Ethereum, DeFi services and instant swap platforms.
Why is this considered a record theft?
TRM calls the $6.36 billion incident the largest crypto theft on record, about four times the $1.5 billion Bybit hack in February 2025. The FBI previously attributed the Bybit theft to North Korea and used the TraderTraitor name for that activity too.
TRM says the Binance attacker moved funds across networks including Ethereum, Bitcoin, XRP Ledger, Tron and Solana. It reported that issuers and other parties froze about $2.67 billion in stablecoins, while the attacker was still holding substantial crypto assets when the firm published its initial analysis.
The FBI’s public alert does not say how much of the stolen value has been recovered or frozen. It says the assets may continue through laundering channels, and directs anyone with relevant information to contact an FBI field office or the Internet Crime Complaint Center.
Sources
- Oct. 31 cyber alert — fbi.gov