The U.S. Federal Bureau of Investigation (FBI) has formally attributed the theft of more than $6 billion in cryptocurrency from Binance to North Korea, identifying the cyber operation as TraderTraitor. The attack, which occurred on or around October 29, 2026, resulted in approximately $6.3 billion in stolen digital assets, making it one of the largest cryptocurrency thefts ever reported.

According to information shared by Coin Bureau, the FBI identified the same North Korean hacking group previously associated with the $1.5 billion security breach at cryptocurrency exchange Bybit. The attribution links two of the most significant cryptocurrency thefts on record and places renewed attention on North Korea-linked cyber operations targeting digital asset platforms.

FBI Names TraderTraitor in Official Cybersecurity Advisory

In an official cybersecurity advisory, the FBI stated that the Democratic People's Republic of Korea (DPRK) was responsible for stealing more than $6 billion in virtual assets from Binance on or around October 29, 2026. The agency specifically refers to the malicious cyber activity as TraderTraitor.

The identification is particularly significant because the group has also been tied to the $1.5 billion Bybit hack. The Binance incident adds another major theft to the record of North Korean hackers and reinforces concerns about the security of centralized cryptocurrency platforms and the movement of stolen digital assets across blockchain networks.

Following the attack, the FBI urged cryptocurrency exchanges, decentralized finance (DeFi) platforms, and other virtual asset service providers to take action against the hackers' wallet addresses. The agency is calling on relevant industry participants to block transactions associated with addresses used by TraderTraitor to move and launder the stolen funds. Because blockchain transactions cannot be reversed once confirmed, blocking requests like this one target the moment stolen assets touch an exchange or service — before they can be exchanged, withdrawn, or moved to fresh addresses.

Binance Says It Has Replenished 90% of Stolen Assets

Binance has moved to address the financial consequences of the incident, assuring customers that they will not be responsible for the stolen funds. The exchange reported that it had already replenished approximately 90% of the losses using its available financial resources, while the remaining 10% is still being addressed as the company works to restore the affected assets.

The company's commitment to covering the full financial impact is intended to ensure that customer balances are not reduced as a result of the security breach. For scale, the shortfall Binance is absorbing from its own resources is roughly four times the $1.5 billion taken in the Bybit breach attributed to the same group.

Binance has also indicated that withdrawals, which were suspended after the attack, are expected to reopen on Sunday, November 1, 2026. Restoring withdrawal services is an important operational step as the exchange works to stabilize its platform and address concerns surrounding the incident.

Crypto Industry Faces Renewed Security Concerns

The Binance incident has drawn attention to the risks associated with large-scale cryptocurrency thefts, particularly when attackers attempt to move substantial amounts of digital assets across multiple services. The FBI's warning places responsibility on exchanges and DeFi service providers to identify and prevent transactions connected to the suspected hackers. That division of labor is central to how the industry responds to cases like this: government agencies issue attributions, while on-chain containment depends on individual platforms choosing to act on the advisory's address list.

With more than $6 billion stolen from Binance and the same TraderTraitor group previously linked to Bybit's $1.5 billion loss, the FBI's announcement marks a significant development in the investigation. Binance, meanwhile, maintains that customers will not bear the financial impact and says it has already covered 90% of the stolen assets ahead of its planned withdrawal reopening on Sunday. The markers worth watching in the days ahead are concrete: how widely exchanges and DeFi platforms implement the FBI's wallet-address blocking request, whether Binance completes the remaining 10% of replenishment, and whether withdrawals resume as scheduled on Sunday, November 1, 2026.

Source: Hokanews