# FBI Attributes $6 Billion Binance Crypto Theft to North Korean Hackers The FBI identifies TraderTraitor as the group behind the largest crypto heist in history. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-11-01 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/6437e28a-be4e-43fd-a7c1-05e8431d4b84 ## Record-Breaking Crypto Heist On October 29, 2026, attackers siphoned approximately $6.36 billion from Binance wallets across ten distinct blockchains. This incident represents the largest cryptocurrency theft on record, exceeding the $1.5 billion Bybit hack of February 2025 by four times. Most of the unauthorized movement occurred within a rapid twenty-minute window starting at 20:05 UTC. ## Attribution to TraderTraitor The FBI has officially attributed the massive breach to the North Korea-linked entity known as TraderTraitor, also identified as Lazarus Group or APT38. Blockchain analysis firms TRM and Chainalysis corroborated this finding with high confidence. The FBI released a public alert to inform private companies and law enforcement agencies about these specific actors. ## Technical Attack Vector The attackers gained unauthorized access by compromising an engineer’s laptop, which provided a gateway to a service container. From this position, they executed unauthorized withdrawal requests across multiple networks. Binance confirmed the security incident and suspended withdrawals on several networks, though the exchange stated there was no evidence that wallet private keys were stolen. ## Laundering and Conversion Tactics The FBI, USSS, and IRS-CI observed the attackers converting the stolen assets primarily into Ethereum. The perpetrators are actively utilizing decentralized finance platforms and instant swap services to obscure the trail of funds. These laundering stages are designed to prepare the assets for further movement while evading detection by traditional financial monitoring systems. ## Industry-Wide Blocking Request Federal agencies are urging THORNode operators, RPC node providers, and DeFi platforms to block transactions linked to the identified wallet addresses. Companies are instructed to check their blocklists against the FBI’s provided data. Furthermore, firms must monitor indirect transaction flows to identify and halt funds derived from the original stolen assets through complex tracing. ## Partial Asset Freezing Efforts Tether, Circle, Ripple, and World Liberty Financial successfully froze approximately $2.67 billion in stablecoins. Additionally, the Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB. Despite these interventions, the attackers managed to move significant portions of the loot into assets like Bitcoin and Ethereum, which lack centralized issuers capable of freezing transactions. ## Unreachable Stolen Assets The attackers effectively outpaced initial freezing efforts by selling USDT to market makers and borrowing ETH against their holdings on Aave. Consequently, the group currently retains control over more than 420,000 ETH and 18,270 BTC. These assets, totaling roughly $2.4 billion, remain beyond the reach of any centralized issuer or regulatory intervention. ## Strategic Security Implications This incident highlights the severe vulnerabilities inherent in managing large-scale virtual asset infrastructure. The FBI remains committed to disrupting North Korea’s illicit cybercrime activities by coordinating with global partners. Organizations are encouraged to report any relevant information to local field offices or the Internet Crime Complaint Center to assist in ongoing investigations. ## Sources covering this story - https://securityaffairs.com/202221/apt/fbi-blames-north-korea-for-6-billion-binance-crypto-theft.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._