The FBI has confirmed that North Korean hackers were responsible for the $6.3 billion cryptocurrency theft from Binance on October 29, identifying the operation as TraderTraitor.
Previously linked to major cryptocurrency attacks, including the $1.5 billion Bybit theft in February 2025, TraderTraitor has a history of targeting developers and exploiting trusted technology providers to access financial systems.
Federal investigators are now tracking the stolen funds and working with cryptocurrency companies to prevent further transfers. Their efforts come as authorities continue to investigate North Korea’s involvement in financial cybercrime.
Why It Matters: TraderTraitor’s repeated success against major cryptocurrency platforms has exposed weaknesses in how organizations protect trusted systems and approve sensitive transactions. Previous attacks have involved compromised technology providers and legitimate employee access, leaving enterprise security teams to account for risks that traditional security controls may miss.
- TraderTraitor Has Been Linked to Previous Attacks: Federal investigators previously connected TraderTraitor to the February 2025 Bybit hack, which resulted in the theft of approximately $1.5 billion in cryptocurrency. During that attack, hackers compromised a third-party wallet provider and altered a transaction approval interface to make unauthorized transfers appear legitimate. The Binance theft involved more than four times that amount, making it the group’s largest publicly attributed cryptocurrency theft to date.
- Developers Have Been Frequent Targets: North Korean hackers have previously used fake job offers and malicious applications to target developers and system administrators with access to sensitive company systems. During the Bybit attack, hackers reportedly posed as recruiters to compromise a developer’s computer and gain access to internal infrastructure. While investigators have not confirmed whether similar tactics were used against Binance, the exchange initially identified a potentially compromised employee laptop as a possible entry point.
- Investigators Are Following the Stolen Funds: The FBI reported that the hackers have been converting much of the stolen cryptocurrency into Ethereum, with further transfers expected through decentralized finance platforms and instant exchange services. These transactions can make the funds harder to trace as they move between different currencies and networks. Federal investigators are working with the Secret Service and IRS Criminal Investigation to track the money and prevent additional transfers.
- Federal Officials Are Asking Companies to Help: Authorities have identified wallet addresses linked to the theft and are urging cryptocurrency exchanges and other digital asset providers to block related transactions. Stopping further transfers will depend on how quickly companies can act, especially as the stolen funds move through different platforms. The effort may be more difficult when transactions involve services operating outside U.S. jurisdiction.
- Binance Has Replenished Most of the Stolen Assets: Binance said it had restored approximately 90% of the stolen funds by October 31, covering roughly $6 billion of the estimated $6.3 billion loss. The exchange also confirmed that major cryptocurrencies were fully backed and that it would cover the losses without passing the costs on to customers. Withdrawals began resuming in phases on November 1 as the company continued investigating the breach.
North Korea responsible for $6 billion Binance cryptocurrency hack, FBI says – Fox Business
$6B Binance Heist Exposes How North Korea Turned Hacking Into a State Revenue Stream – The Diplomat
