FBI Attributes $6 Billion Binance Hack to North Korea's TraderTraitor Group
Key Takeaways
- •The FBI attributed the theft of roughly $6 billion from Binance to TraderTraitor, a hacking group linked to North Korea.
- •Approximately $6.36 billion in digital assets was transferred from Binance wallets across 10 blockchains in a rapid, coordinated operation, making it reportedly the largest cryptocurrency theft on record.
- •The Binance breach is more than four times the size of the $1.5 billion Bybit theft in 2025, which the FBI also attributed to TraderTraitor and which had previously been the biggest documented crypto theft.
- •Binance has frozen around $3 billion of the stolen assets, covering close to half of the total, while the status of the remaining funds remains unresolved.
- •U.S. authorities designate TraderTraitor as North Korean state-sponsored cyber actors targeting the digital asset industry, and Western governments and UN researchers assess that such theft proceeds help finance the country's weapons programs.
The Federal Bureau of Investigation has attributed the theft of roughly $6 billion from cryptocurrency exchange Binance to TraderTraitor, a hacking group linked to North Korea, citing a report by Cointelegraph.
The incident involved the transfer of approximately $6.36 billion in digital assets from Binance wallets across 10 blockchains, moved in what the report describes as a rapid operation. The scale and speed of the transfers point to a highly coordinated and sophisticated cyberattack, and the breach is reportedly the largest cryptocurrency theft on record. Tracing funds dispersed across that many networks generally depends on coordinated on-chain analysis involving exchanges, blockchain analytics firms, and law enforcement.
The attribution extends the FBI's earlier identification of TraderTraitor as the perpetrator of a $1.5 billion theft from exchange Bybit in 2025 — a breach that had until now ranked as the biggest crypto theft documented. By the report's figures, the Binance theft is more than four times the size of the Bybit breach.
According to the report, Binance has frozen roughly $3 billion of the affected assets — a sum covering close to half of the stolen total, which leaves the status of the remaining funds the main open question in recovery efforts.
TraderTraitor is a designation used by U.S. authorities for North Korean state-sponsored cyber actors that target the digital asset industry. U.S. agencies have repeatedly warned that these groups compromise exchanges and blockchain companies through social engineering, phishing campaigns, and supply-chain intrusions. Western governments and United Nations researchers have assessed that proceeds from North Korean cryptocurrency thefts help finance the country's weapons programs.
The attribution of the largest theft on record to a state-linked group adds to persistent security concerns across the cryptocurrency sector, which has repeatedly been targeted by North Korean cyber operations in recent years. Developments to watch include additional freezing or recovery efforts, further technical disclosures from investigators or Binance, and any follow-up action by U.S. or international authorities.
