FBI Attributes Binance Attack to North Korea, Damage Estimated at Approximately $6.3 Billion
The FBI said North Korea was behind the theft of more than $6 billion in virtual assets from Binance. It identified the activity as TraderTraitor.
The FBI attributed the attack on Binance to North Korea and the activity known as TraderTraitor. According to an FBI statement dated October 31, the incident involved the theft of more than $6 billion in virtual assets, which occurred around October 29.
Binance confirmed the attack in its own announcement. The exchange said its hot wallet was attacked at approximately 04:05 UTC+8 on October 30 and that the estimated loss amounted to approximately $6.3 billion. The company also stated that it would bear the financial loss itself, rather than its users.
FBI Attributed Binance Attack to TraderTraitor Activity
The U.S. Federal Bureau of Investigation identified the activity as TraderTraitor and attributed it to North Korea. The FBI said it monitored subsequent transfers of the stolen assets together with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation division (IRS-CI).
According to the FBI, the funds were transferred primarily into ETH. The agency therefore urged cryptocurrency-sector service providers to block flagged addresses associated with laundering these assets.
Different Damage Estimates and Undisclosed Cause
The estimated damage varies slightly among the available statements. Binance is working with an estimate of approximately $6.3 billion. Based on on-chain data, analytics firm TRM Labs estimated the volume of transferred assets at $6.36 billion across ten blockchains. According to its own methodology, TRM Labs described the case as the largest recorded cryptocurrency theft.
The final value of the stolen funds may change depending on how much of the assets is frozen, seized, or returned, as well as on cryptocurrency price movements.
Binance has not yet disclosed the full technical cause of the compromise. In its analysis, TRM Labs suggested a possible compromise of the infrastructure used to sign hot-wallet transactions. However, this is not an officially confirmed cause from Binance.
What Happens Next
For Binance users, the key point is that the company stated it would absorb the financial loss. Further information is expected mainly on the cause of the incident, the restoration of services, and the extent of the costs Binance will bear.
It remains open how much of the funds can be frozen or recovered, and whether criminal, sanctions-related, or regulatory actions will follow from the United States or other countries.
Sources
- FBI Cyber – Official attribution of the theft to North Korea and TraderTraitor, the incident date, observed transfers into ETH, and the call to block flagged addresses.
- Binance Announcement – Confirmation of the hot-wallet attack, the approximate $6.3 billion loss, and Binance’s commitment to cover users’ losses.
- TRM Labs – On-chain estimate of $6.36 billion, the scope across ten networks, the context of the record cryptocurrency theft, and the technical hypothesis.
- Associated Press – Independent confirmation that the FBI attributed the incident to North Korean actors and that it was the largest cryptocurrency theft by scale.
Verified and updated: 11/01/2026 15:20
