The FBI has attributed the theft of approximately $6.3 billion from Binance to North Korea, identifying the malicious activity as TraderTraitor. The attack occurred around October 29, 2026, at the world's largest cryptocurrency exchange. The bureau previously blamed the same group for the $1.5 billion Bybit theft in February 2025.
Attackers gained access to Binance's hot wallets, which hold internet-connected digital assets. Although an initial investigation pointed to a compromised engineer's laptop as a possible entry point, Binance subsequently identified additional breaches. The company characterized the incident as a complex attack involving multiple factors.
Working with the US Secret Service and the IRS's criminal investigators, the FBI observed the attackers converting stolen assets primarily into ether. The agencies urged cryptocurrency businesses to block transactions linked to the attackers' addresses, warning that further conversions could help obscure the funds' origins.
Binance suspended deposits and withdrawals during security checks, then began restoring withdrawals in phases on November 1. Its initial phase prioritized networks and assets with the greatest user demand during the preceding week. Deposits remained open, and the exchange reported that it had covered approximately 95% of the stolen amount.
The remaining 5% comprised less liquid tokens that required more time to acquire in sufficient quantities. Binance allocated more than $6.34 billion from company resources, including its emergency user-protection reserve, futures insurance fund and corporate treasury. It said it would absorb the financial impact rather than transfer the losses to customers.
