CryptoNov 3, 2026, 4:02 AM UTC·2 min read

Binance Hack: FBI Blames North Korea's TraderTraitor for $6B Theft

The FBI has officially attributed the Binance theft of more than $6 billion to North Korea's TraderTraitor unit, part of Lazarus, which is now laundering the funds.

Image: 01net.com

SUMO

Dialo

ediviewer

The FBI has officially attributed the Binance hack to North Korea. In a notice published on Saturday, October 31, two days after the attack, the agency said the country is responsible for the theft of more than $6 billion in virtual assets from the exchange on or about October 29, 2026.

The bureau points to TraderTraitor, a hacking unit working for the North Korean government and part of the wider Lazarus organization. The finding is hardly a surprise: analytics firm TRM Labs had already linked the attack to TraderTraitor "with high confidence" the day after the theft. Chainalysis noticed that funds taken from Binance had mixed with those stolen from Bitget last month, another victim of the same group.

Hundreds of addresses to block

The FBI, working with the USSS and IRS-CI, has seen the attackers convert the loot mainly into Ethereum, and expects them to launder it further through DeFi and instant swap services. It published a list of addresses: several hundred on Ethereum, 19 on Bitcoin and one on Solana. Exchanges, DeFi services, blockchain analytics firms and operators of THORChain and other nodes are urged to block related transactions.

Cooperation is not guaranteed. After the 2025 Bybit hack, North Korean hackers swapped more than $1 billion of ether for bitcoin on THORChain. Operators considered blocking transactions, but a project developer resigned in protest. Chainalysis says about $2.8 billion has nevertheless been frozen. Tracking the Binance funds is especially hard: the attackers already use thousands of addresses across many networks and could use tens of thousands in the coming weeks.

A repeat offender funding the regime

TraderTraitor previously stole $1.5 billion from Bybit in February 2025 and $292 million from KelpDAO a few months later. Chainalysis estimates North Korean hackers took $2.02 billion from crypto platforms last year. Ari Redbord of TRM Labs says the money helps finance "weapons proliferation and other destabilizing activities", and crypto is known to fund the regime's ballistic missiles. "It's a bank heist at internet speed. But we can also trace the funds in real time to build cases," he said.

The group often poses as recruiters or gets hired by target companies, then compromises a third party's computer rather than breaking wallet encryption. At Binance, the attack reportedly began with malware on an engineer's laptop. "The weakest link in a cyberattack remains the human," said Silviu Stahie of Bitdefender.