Binance Hack North Korea Link: FBI Blames TraderTraitor for $6B Theft

The Binance hack North Korea link is now official: the FBI has blamed North Korea’s TraderTraitor hacking group for stealing more than $6 billion from Binance, the world’s largest cryptocurrency exchange. The theft, carried out within minutes on 29 October, is the biggest crypto heist on record, the Associated Press reported.

The FBI and the U.S. Secret Service attributed the attack in messages over the 31 October to 1 November weekend. Estimates of the total stolen range from about $6.3 billion to $6.4 billion. Together with the IRS Criminal Investigation unit (IRS-CI), the agencies urged the crypto industry to stop the stolen funds from being laundered.

What the FBI said about the Binance hack and North Korea

The FBI said TraderTraitor actors were converting the stolen assets primarily into Ethereum (ETH). “It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages,” the agency said.

The FBI published a list of crypto addresses it said hold, or at some point held, funds from the theft. According to reports on the notice, the list included more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address.

The agencies called on exchanges, decentralized finance (DeFi) services, THORChain node operators, RPC node operators, instant exchanges, blockchain analytics firms and other virtual asset service providers to “block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.”

Who is TraderTraitor?

TraderTraitor is a subunit of the Lazarus Group, which sits under North Korean military intelligence. The FBI previously linked the same group to the $1.5 billion Bybit hack in February 2025.

According to a United Nations Security Council Panel of Experts report cited by NPR, cyber theft provides about half of North Korea’s foreign currency earnings and funds about 40% of its weapons of mass destruction programs.

How the Binance hack unfolded

Blockchain analytics firm Chainalysis said funds began leaving Binance hot wallets across multiple blockchains at around 4:20 p.m. Eastern Time on 29 October. Binance has said the attackers gained access through a Binance engineer’s laptop, which allowed them to submit unauthorized withdrawal transactions.

Chainalysis said its strongest evidence for North Korean involvement came when it watched funds stolen from Binance mix on-chain with funds from the earlier Bitget theft, which had already been linked to North Korea.

How much has been frozen

The Secret Service said that within minutes of the attack it worked with crypto companies and the Justice Department to “identify and freeze a significant portion of stolen cryptocurrency.” TRM Labs, another blockchain monitoring firm, told NPR that crypto firms froze more than 40% of the stolen assets. Chainalysis put the frozen amount at about $2.8 billion.

Trading resumed on Binance on Sunday, 1 November, after some transactions were halted following the theft.

In my view, the speed of the freezes is the most important part of this story. Blocking more than 40% of a theft this large shows how much public blockchains and industry cooperation can limit damage, even when the attacker is a state-backed group. For the full timeline of the theft, read our earlier report on the Binance hack and the more than $6 billion stolen, and for how AI is being used to find code flaws in crypto, see JAIST’s AI for smart contract vulnerabilities.