FBI blames North Korea's TraderTraitor for record $6.43 billion Binance crypto theft

The U.S. Federal Bureau of Investigation has attributed the theft of more than $6 billion in virtual assets from the crypto exchange Binance to TraderTraitor, a North Korea-aligned threat group, according to a report published by The Hacker News on November 1, 2026. The FBI, the U.S. Secret Service and IRS Criminal Investigation said the actor was mainly converting the stolen funds into Ether, the report states.

What happened

The Hacker News reports that the FBI tied the heist to TraderTraitor, a cluster also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899 and active since at least 2020. According to the report, the agencies said the attackers are expected to launder the funds further by "converting them using DeFi and instant swap services," and the FBI published a list of wallet addresses the attackers are using.

The Hacker News puts the stolen amount at $6.43 billion, though it notes a related headline on the same page cites $6.3 billion, so the figures are not fully consistent. Citing blockchain analytics firm Elliptic, the report says the haul exceeds the $1.46 billion stolen from Bybit in February 2025, making it the largest cryptocurrency theft on record. Elliptic described the incident as one that "almost doubles the total cryptoassets stolen by the regime," and estimates North Korea-linked actors have stolen over $6.5 billion in crypto in recent years.

Technical details

The report says the funds were stolen across 11 blockchains, with 82% held on Ethereum and Bitcoin, and that $2.85 billion has been frozen on-chain by Tether, Circle, Ripple, Arbitrum and Optimism. The Hacker News does not describe how the attackers initially broke into Binance. It does summarize TraderTraitor's known tradecraft as reported by Microsoft, SentinelOne and Zscaler ThreatLabz: trojanized Terraform providers that deliver a Bash loader, a cross-platform implant called FLATROOF that runs a Python infostealer before dropping the ROOFDECK backdoor, and job-themed social engineering in which operators pose as recruiters using tailored domains and fake personas.

Who is affected

Binance customers were directly affected by the disruption to withdrawals. The broader crypto market is exposed through the laundering of stolen assets across multiple chains and swap services, which the frozen funds only partially contain.

What to do

According to The Hacker News, Binance paused withdrawals after the incident and resumed "phase one" on November 1 between 6 and 9 a.m. UTC, saying it aims "to restore withdrawals progressively as we complete security and readiness checks"; deposits were "not affected by the incident." Organizations in the crypto and blockchain sector should treat the FBI's published wallet addresses as indicators and remain alert to TraderTraitor's recruiter-themed social engineering, which the report says targets employees with fake job offers and trojanized developer tools.