The FBI has attributed the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance to North Korea, describing the operation as part of a DPRK-linked cyber campaign known as “TraderTraitor.”
In an October 31 alert, the bureau said the theft took place on or around October 29, 2026. The FBI said it is working with the U.S. Secret Service and IRS Criminal Investigation to track the stolen assets and disrupt efforts to launder them.
According to the agency, TraderTraitor actors have been converting stolen assets primarily into Ethereum. Authorities expect the funds to be moved further through decentralized finance platforms and instant-swap services as part of subsequent laundering stages.
The FBI, USSS and IRS-CI urged cryptocurrency companies, blockchain analytics firms, DeFi services and other virtual-asset providers to block transactions involving addresses identified as being used by the North Korean-linked actors. The FBI also published an extensive list of Ethereum addresses it said were holding, or had previously held, assets connected to the theft.
The attribution places the Binance theft among the largest cryptocurrency attacks publicly linked to North Korean cyber operations.