The United States Federal Bureau of Investigation has attributed a cryptocurrency theft involving more than $6 billion in virtual assets from Binance to North Korea, highlighting the growing cybersecurity challenges facing the global digital asset industry.
In its cybersecurity alert dated October 31, 2026, the FBI said North Korea was responsible for the theft from Binance, one of the world's largest cryptocurrency exchanges. According to the agency, the incident occurred on or around October 29.
Editorial Insight
Key Highlights
Important points readers should notice.
The FBI attributed the Binance cryptocurrency theft to North Korea.
The agency issued its cybersecurity alert on October 31, 2026.
The theft occurred on or around October 29, according to the FBI.
The operation was identified as TraderTraitor.
The stolen assets were being converted primarily into Ethereum.
The FBI, US Secret Service and IRS Criminal Investigation are involved in the response.
The FBI identified the specific cyber activity as TraderTraitor, a designation associated with North Korean malicious cyber operations.
The agency said it had observed the actors converting the stolen assets primarily into Ethereum (ETH). The FBI also warned that further laundering could take place through decentralised finance (DeFi) platforms and instant cryptocurrency swap services.
The FBI, together with the United States Secret Service (USSS) and the Internal Revenue Service Criminal Investigation division (IRS-CI), urged cryptocurrency businesses, blockchain service providers and other relevant organisations to identify and block transactions involving wallet addresses associated with the operation. The agency also published a list of addresses connected to the activity.
Binance's Response
Binance reported that approximately $6.3 billion in cryptocurrency was stolen during the incident. The exchange said it had committed company resources to cover the affected assets and was coordinating with law-enforcement agencies and blockchain partners.
In an update published on November 1, Binance said it had covered approximately 95% of the affected amount. The company explained that it had used its own funds to obtain replacement tokens for the affected assets.
Binance also began restoring cryptocurrency withdrawals in phases following security checks. The exchange said the remaining portion involved less-liquid assets that could take longer to source in the required quantities.
International Cybersecurity Concerns
The FBI's attribution has brought renewed attention to North Korea-linked cyber operations targeting cryptocurrency platforms.
The movement of stolen digital assets across blockchain networks and through different financial services can make investigations and recovery efforts difficult. The FBI's warning about further laundering reflects concerns that the stolen assets could be transferred through multiple services to obscure their movement.
The investigation and cooperation between US agencies, cryptocurrency exchanges and blockchain service providers remain important to efforts to trace the funds and prevent further transfers.
The incident has also raised questions about the security arrangements used by major cryptocurrency platforms to protect digital assets against sophisticated cyberattacks.
