The FBI attributes the $6B+ Binance hack to North Korea's TraderTraitor hacking group, which the agency also previously blamed for the ~$1.5B Bybit hack

This confirms the FBI's ongoing attribution of major crypto hacks to North Korea, signaling continued international cybercrime enforcement.

The FBI has attributed the theft of over $6 billion in virtual assets from cryptocurrency exchange Binance to North Korea's "TraderTraitor" hacking group. This group was previously blamed for a similar heist of approximately $1.5 billion from Bybit. The FBI, in conjunction with the US Secret Service and IRS Criminal Investigation, stated that North Korea, also known as the Democratic People's Republic of Korea, was responsible for the Binance attack, which occurred on or around October 29, 2026. Investigations have revealed that TraderTraitor actors typically convert stolen assets, primarily into Ethereum (ETH), with the intention of further laundering through decentralized finance (DeFi) and instant swap services. The FBI is urging private sector entities, including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers, to block transactions associated with addresses linked to TraderTraitor.

The FBI's public attribution of the massive Binance hack to North Korea's TraderTraitor group, coupled with the previous Bybit incident, underscores the persistent threat posed by state-sponsored hacking operations in the cryptocurrency space. The group's known methods of converting stolen assets into Ethereum and then utilizing DeFi and instant swap services for laundering highlight the evolving tactics employed to obscure illicit financial flows. This also points to a growing challenge for regulatory bodies and cybersecurity firms in tracing and interdicting these sophisticated operations across global financial networks.

The FBI's call to action for private sector entities, including node operators and virtual asset service providers, to block transactions linked to TraderTraitor indicates a strategy of coordinated disruption. This approach aims to choke off the ability of North Korea to monetize stolen digital assets by making it harder for them to move and launder funds. The success of this strategy will likely depend on the willingness and technical capability of these private entities to implement the requested blocks, potentially leading to increased collaboration between law enforcement and the cryptocurrency industry.