The Federal Bureau of Investigation (FBI) has formally attributed the theft of approximately $6.3 billion in cryptocurrency from Binance to North Korea, identifying the hacking operation as the work of a group known as TraderTraitor. The incident, reportedly occurring on or around October 29, 2026, ranks among the most significant security breaches in the history of the cryptocurrency industry.

According to information reported by Coin Bureau, the FBI linked the attack to the same North Korean hacking group previously associated with the $1.5 billion theft from cryptocurrency exchange Bybit. The latest attribution connects two major cryptocurrency thefts to a single group — together totaling roughly $7.8 billion — highlighting the continuing security challenges facing centralized exchanges and digital asset platforms.

FBI Identifies North Korean Hacking Group

In an announcement dated October 31, 2026, the FBI identified TraderTraitor as responsible for stealing more than $6 billion in virtual assets from Binance, formally attributing the operation to the Democratic People's Republic of Korea (North Korea). Attributions of this kind give exchanges and other service providers a common reference point for identifying funds tied to a specific theft.

The agency also issued a warning to cryptocurrency exchanges, decentralized finance (DeFi) services and other organizations operating in the digital asset sector. It urged industry participants to identify and block transactions involving cryptocurrency addresses associated with the hackers as they attempt to move and launder the stolen funds.

The warning reflects concerns about illicit cryptocurrency being moved through multiple blockchain addresses and financial services. Address-level blocking is aimed at an early stage of the laundering process: stolen cryptocurrency remains traceable on-chain while it sits at known addresses, and intercepting it becomes harder once it is dispersed across multiple services. By directing its request at exchanges, DeFi platforms and other virtual asset service providers, the FBI is seeking to prevent the stolen funds from entering the wider cryptocurrency markets.

TraderTraitor Previously Linked to $1.5 Billion Bybit Hack

The Binance incident is not the first major cryptocurrency theft attributed to TraderTraitor. In February 2025, the FBI identified the same North Korean-linked operation as responsible for stealing approximately $1.5 billion in digital assets from Bybit, a case that established the group as a significant threat to the cryptocurrency industry.

The FBI's latest announcement now connects the group to another multibillion-dollar incident, this time involving Binance and more than $6 billion in stolen virtual assets. The connection between the two cases is particularly notable because both involve major cryptocurrency trading platforms. However, the FBI's attribution does not, by itself, establish that the attacks used identical methods or exploited the same security weaknesses.

Binance Says Users Will Not Bear the Losses

Binance has said its customers will not be responsible for the financial impact of the theft. The exchange reported that it had already replenished 90% of the affected assets using its own financial resources, with the remaining losses still to be covered. The recovery effort is intended to protect customer balances while the exchange addresses the consequences of the security incident.

Binance also indicated that withdrawals would reopen on Sunday, following the disruption caused by the attack. The exchange's commitment to covering the losses is a central element of its response to the incident, even as the FBI focuses on identifying the perpetrators and preventing further movement of the stolen cryptocurrency. The details still to develop include the coverage of the remaining losses, the scheduled reopening of withdrawals, and how exchanges and DeFi services act on the FBI's request to block the addresses tied to the hackers.

With the FBI formally identifying TraderTraitor and Binance reporting that 90% of the losses had already been covered, the incident remains a significant case involving cryptocurrency theft, international cybercrime and exchange security.