State-sponsored hackers known as TraderTraitor executed the breach, prompting the cryptocurrency platform to suspend withdrawals and move to cover user balances.
Federal investigators formally pointed to the regime of Kim Jong-un after tracing the intrusion back to state-backed digital theft operations. The operation targeted one of the world’s primary cryptocurrency exchanges, representing the largest attack recorded against a cryptocurrency platform. According to the U.S. Federal Bureau of Investigation, the digital assault unfolded around October 29, 2026, catching the industry by surprise and rattling broader markets.
In its formal announcement, the federal agency noted that the Democratic People’s Republic of Korea was responsible for taking over six billion dollars in virtual assets from the exchange. The organization faced an unprecedented stress test as the intrusion unfolded.
The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North… pic.twitter.com/TBUvUFln4n
How TraderTraitor Breached Binance Systems
Preliminary internal investigations by the company indicate that an operations engineer’s laptop was compromised, providing attackers an entry point into corporate infrastructure. Co-executive officer Richard Teng characterized the incident as a complex attack involving malicious software engineered specifically to erase digital footprints and evade standard tracking mechanisms.
Security analysts observed that the hackers exploited vulnerabilities in smart contracts across cross-chain bridges while compromising private key infrastructure. This method allowed the group to siphon funds rapidly into decentralized wallets before moving assets into mainstream circulation.
Binance Replaces 90% of Stolen Assets
In response to the massive intrusion, the platform locked down deposits and withdrawals while executing emergency financial measures to protect customer accounts. Executives confirmed that the company has already replaced 90% of the stolen assets by purchasing new tokens using corporate treasury funds.
We have already replaced 90% of the stolen assets and we are committed to covering the remaining 10%. Our users will not suffer the financial impact of this incident.
Richard Teng, Co-CEO of Binance
To manage the crisis, Binance drew from its User Safe Asset Fund, known as SAFU, alongside futures insurance reserves and corporate funds. The remaining deficit involves tokens that the company continues to acquire through open market operations and over-the-counter agreements until the replacement process reaches completion.
As part of its ongoing proof of reserves protocol, the company executed a fresh snapshot of platform holdings at 00:00 GMT on October 31. Leadership noted that users holding major cryptocurrencies will be able to verify that their holdings maintain a minimum 1-to-1 backing.
Federal Warnings on Cryptocurrency Laundering
Following the breach, federal agencies issued urgent directives to private digital asset firms. The FBI, alongside the U.S. Secret Service and IRS Criminal Investigation, called on decentralized finance providers and node operators to block transactions linked to specific digital addresses utilized by the TraderTraitor network.
Investigators noted that the stolen capital was converted primarily into Ethereum. In an official advisory, the FBI stated:
The FBI is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026.
FBI links North Korea to theft of $6 billion from Binance https://t.co/LG20F2DlO7
Blockchain intelligence firm Chainalysis reported that the number of addresses associated with the operation continues to expand, demonstrating a deliberate strategy of asset dispersion and laundering designed to obstruct tracking and recovery efforts.
Cryptocurrency Markets Drop After Breach Disclosure
The scale of the breach triggered immediate tremors across global cryptocurrency markets. The value of Bitcoin and Ether experienced drops exceeding 8% in the hours following the disclosure, reflecting heightened investor anxiety over custody security within a global market encompassing roughly 741 million cryptocurrencies.
FBI Attributes Over $6B Binance Hack to North Korea, Urges THORNode Operators and Other Crypto Service Providers to Block Money Laundering-Linked TransactionsThe FBI attributed the theft of more than $6 billion in crypto assets from Binance to North Korean hackers, identifying… pic.twitter.com/mIMYUqgOxt
U.S. authorities noted that TraderTraitor maintains a history of other robberies.