Pecohub The United States Federal Bureau of Investigation (FBI) has formally attributed the theft of more than $6 billion in cryptocurrency from Binance to North Korea, identifying the cyber operation as TraderTraitor.
In a cyber alert issued on October 31, the FBI said the theft occurred on or around October 29, 2026. The agency said it was working with the United States Secret Service (USSS) and the Internal Revenue Service Criminal Investigation division (IRS-CI) to track the stolen assets.
According to the FBI, the attackers have been converting the stolen cryptocurrency primarily into Ethereum (ETH). Investigators expect the funds to be moved through decentralised finance (DeFi) platforms and instant cryptocurrency swap services as part of efforts to conceal their origins.
The FBI, USSS and IRS-CI have urged cryptocurrency exchanges, THORNode operators, remote procedure call (RPC) node operators, DeFi platforms, blockchain analytics companies and other virtual asset service providers to block transactions involving identified wallet addresses associated with the operation.
The FBI has also published a list of cryptocurrency addresses linked to the laundering activity to help industry operators identify and stop suspicious transactions.
The incident has been estimated at approximately $6.3 billion, making it one of the largest cryptocurrency thefts ever reported. Blockchain intelligence firm TRM Labs had earlier linked the attack to TraderTraitor, a North Korean hacking operation previously associated with major cryptocurrency thefts.
The FBI’s attribution now places North Korea at the centre of the investigation, while efforts continue to trace and disrupt the movement of the stolen funds.
