FBI says N. Korea responsible for over US$6 bln crypto theft from Binance

The FBI said North Korean hackers stole more than US$6 billion in virtual assets from Binance on or about October 29, 2026. Binance is described as the world's largest cryptocurrency exchange. The disclosure came in a cyber alert identifying the Democratic People's Republic of Korea as responsible.

The FBI called the operation TraderTraitor. It said the hackers were converting the stolen assets primarily into Ethereum. The FBI made that observation with the U.S. Secret Service and the Internal Revenue Service's Criminal Investigation division.

The theft matters because the stolen funds could continue moving through decentralized finance platforms and exchanges that quickly swap digital assets. The FBI, Secret Service and IRS urged virtual asset providers to block transactions involving wallet addresses used to launder the money. TRM Labs separately estimated the theft at $6.36 billion.

TraderTraitor is the name the FBI used for the North Korean cyber operation connected to the Binance theft. The agency identified the Democratic People's Republic of Korea as responsible for stealing more than US$6 billion in virtual assets around October 29, 2026.

The name matters because it is not new in the FBI's reporting. The agency said TraderTraitor had previously been associated with cryptocurrency thefts carried out by North Korean hackers. In this case, the FBI also observed the hackers converting the stolen assets primarily into Ethereum.

The operation remains significant because the funds were expected to move through decentralized finance platforms and cryptocurrency exchanges. Those services can quickly swap one digital asset for another. The FBI, Secret Service and IRS asked providers to block transactions involving wallet addresses used by the hackers to launder the stolen funds.

The FBI reported that more than US$6 billion in cryptocurrency was stolen from Binance. A U.S. blockchain intelligence firm, TRM Labs, later estimated the theft at $6.36 billion. Those figures describe the same reported incident, with the FBI using a rounded amount and TRM Labs giving a more precise estimate.

The article does not provide a typical cyber-theft figure, so it cannot support a numerical comparison with ordinary attacks. Still, a multibillion-dollar cryptocurrency theft is an exceptionally large reported loss in absolute terms. Binance is described as the world's largest cryptocurrency exchange, which underscores the scale of the target.

The amount also raises concern about what happens next. The FBI expected the hackers to launder the assets through decentralized finance platforms and exchanges. Three U.S. agencies urged service providers to block wallet addresses involved in moving the stolen funds.

The FBI said the hackers were converting stolen assets primarily into Ethereum. Ethereum is described in the article as a major cryptocurrency. The agency reported this activity while working with the U.S. Secret Service and the IRS Criminal Investigation division.

The article does not explain the hackers' reason for choosing Ethereum. It therefore does not establish whether the conversion was intended to make movement easier, support laundering, or serve another purpose. What it does establish is the key mechanism: one digital asset was exchanged for another after the Binance theft.

That conversion mattered because the FBI expected further laundering through decentralized finance platforms and cryptocurrency exchanges. These services can quickly swap one digital asset for another. The FBI, Secret Service and IRS urged providers to block transactions involving wallet addresses used by the hackers, including addresses involved in laundering the stolen funds.

When stolen cryptocurrency is laundered, the funds are moved through services and transactions intended to handle illicit assets. The FBI warned that the Binance hackers were expected to use decentralized finance platforms and cryptocurrency exchanges that allow rapid swaps between digital assets.

The key mechanism is repeated conversion and movement. A stolen asset can be exchanged for another digital asset, then transferred through additional platforms or wallet addresses. This can spread the funds across a more complicated transaction trail. The article specifically says the exchanges allow users to quickly swap one digital asset for another.

The immediate consequence is a greater risk that the stolen funds will continue circulating. The FBI, Secret Service and IRS urged exchanges, blockchain operators, analytics firms and other virtual asset providers to block transactions involving the hackers' wallet addresses. Their warning aimed to interrupt laundering before more funds move.

Cryptocurrency exchanges, blockchain operators and analytics firms can help by identifying wallet addresses associated with the hackers and blocking transactions involving those addresses. The FBI, U.S. Secret Service and IRS specifically urged these providers to take that step.

Blockchain records give investigators transaction trails to examine. Providers can compare new transfers with known wallet addresses, flag connected activity and stop or restrict transactions before stolen funds move farther. Analytics firms can help organize those links across wallets and services. The article does not describe a specific technical system, so these are general ways the named providers can respond.

The warning is urgent because the hackers were expected to launder the assets through decentralized finance platforms and exchanges. Such services can quickly swap one digital asset for another. Blocking connected transactions can disrupt that process, while cooperation among providers can help investigators follow the funds.

Cryptocurrencies can move without a central bank because a distributed network maintains the blockchain ledger. Network participants validate transactions under the system's rules, and the ledger records the transfer. Users control digital assets through cryptographic keys rather than through a bank account managed by a central authority.

A transfer generally moves assets from one wallet address to another. The blockchain records details such as the addresses, amount and time, although an address may not directly show a person's real name. Investigators and analytics firms can examine connected transactions and follow funds as they move between wallets and services.

That combination creates both independence and visibility. No central bank needs to approve every transfer, but the public transaction history can leave a durable trail. In this case, the FBI urged providers to block transactions involving wallet addresses used by the hackers, while agencies monitored the assets' movement.