Over $6 billion in 20 minutes: FBI accuses North Korea of largest-ever crypto hack against Binance

On October 29, attackers stole more than $6 billion in cryptocurrency from Binance wallets. The FBI called it the largest cryptocurrency theft in history. The breach mattered because the funds moved rapidly across multiple blockchain networks, creating an urgent race to trace and block them.

The FBI attributed the attack to TraderTraitor, a North Korean hacking operation. TRM Labs estimated that about $6.36 billion moved across 10 networks, mostly within roughly 20 minutes. The firm assigned the operation to TraderTraitor with high confidence. Investigators also observed the hackers converting stolen assets, mainly into Ethereum.

The attribution reflects several pieces of evidence described in the alert, including blockchain movement and links to wallet addresses. The FBI, Secret Service, and IRS investigators published addresses connected to the theft. They warned that further conversions, DeFi services, and instant exchanges could make recovery harder. Binance said it replenished about 90% of the stolen cryptocurrency and reserved company funds for losses.

TraderTraitor is described in the article as a North Korean hacking operation. The FBI used the name when identifying the perpetrators of the Binance attack. It is not presented as a cryptocurrency, exchange, or legitimate financial service. Its role here was to conduct a cyberattack against digital-asset wallets.

The operation stole cryptocurrency from Binance wallets and moved the assets across 10 blockchain networks. Most of the transfers happened in roughly 20 minutes. Investigators then observed TraderTraitor operatives converting the stolen assets, primarily into Ethereum. The article also connects the group with wallet addresses on Ethereum, Bitcoin, and Solana.

The group’s activity did not end with the theft. US agencies warned that the assets could undergo additional laundering through decentralized finance platforms and instant cryptocurrency exchanges. Those routes may complicate tracing and recovery. The FBI therefore asked exchanges, node operators, DeFi services, instant exchanges, and analytics firms to block addresses linked to the hackers.

The theft involved approximately $6.36 billion in cryptocurrency, according to blockchain intelligence firm TRM Labs. That estimate covers funds transferred from Binance wallets during the October 29 attack. The article describes it as the largest cryptocurrency theft in history, surpassing earlier attacks on digital-asset exchanges.

The money moved across 10 blockchain networks. Most of the assets were transferred in roughly 20 minutes. This speed compressed the time available for Binance, exchanges, investigators, and blockchain operators to identify suspicious wallets and stop further movement. TRM Labs attributed the operation to TraderTraitor with high confidence.

The scale also made the aftermath complex. The FBI published a long list of wallet addresses on Ethereum, Bitcoin, and Solana that either held or previously held stolen assets. Investigators said the hackers had already begun converting the funds, primarily into Ethereum. Further movement through DeFi platforms and instant exchanges could make tracing and recovery more difficult.

After the breach, Binance suspended withdrawals and worked to restore service. The exchange said it had replenished approximately 90% of the stolen cryptocurrency. It also set aside about $6.34 billion in company funds to cover the losses. Binance said it would use its corporate treasury and financial reserves to protect customers.

The response was designed to keep customers from losing most of their deposited assets because of the attack. Binance pledged to cover customers’ losses rather than making them absorb the breach’s direct financial impact. The company also worked with blockchain partners to identify and freeze affected assets. Its co-CEO, Richard Teng, described the incident as a complex attack involving a compromised laptop and malware designed to erase evidence.

The replacement does not recover every stolen coin. It is Binance’s financial response while investigators pursue the assets. The FBI warned that the hackers were converting funds and might move them through DeFi services and instant exchanges. Binance said it was working to restore normal operations on Sunday after the withdrawal suspension.

The FBI observed TraderTraitor operatives converting the stolen digital assets primarily into Ethereum. The article does not state a specific reason for choosing Ethereum. It does explain the broader concern: changing assets and routing them through different services can make the stolen funds harder for investigators to follow.

The agencies warned that the assets could undergo additional laundering through decentralized finance platforms and instant cryptocurrency exchange services. The hackers had already begun converting the funds when the FBI issued its alert. These movements could spread the assets across more wallets, cryptocurrencies, and services, complicating efforts to identify and recover them.

That is why US agencies asked exchanges, THORNode operators, RPC node operators, instant exchanges, DeFi services, and analytics firms to block connected addresses. The FBI published addresses on Ethereum, Bitcoin, and Solana that held or previously held stolen assets. Even with those leads, continued movement could make intervention harder.

Decentralization does not make cryptocurrency transfers invisible. Blockchain transactions leave records that investigators and blockchain intelligence firms can analyze. In this case, the FBI published wallet addresses that either held or previously held assets stolen during the Binance attack. That gave exchanges and infrastructure providers specific identifiers to monitor.

The FBI also coordinated with the US Secret Service and the IRS’s Criminal Investigation division. Agencies observed the funds moving and converting, while TRM Labs estimated the total and linked the operation to TraderTraitor. Exchanges, blockchain operators, instant exchanges, DeFi services, and analytics firms can compare new transactions with the listed addresses.

The agencies asked those organizations to block transactions involving wallets controlled by or closely connected to the hackers. Binance said it worked with blockchain partners to identify and freeze affected assets. This approach cannot guarantee recovery, especially after further laundering, but coordinated monitoring and service-level controls can interrupt movement.

Cryptocurrency is digital value recorded and transferred electronically. A digital wallet is the tool or address used to receive, hold, and send that value. A blockchain is a shared record of transactions maintained across a network. The source article uses these systems but does not provide formal definitions, so this explanation adds standard background knowledge.

A transfer generally moves cryptocurrency from one wallet address to another and records that movement on the relevant blockchain. No traditional bank needs to approve each transaction. Instead, the network records and verifies activity through its own technical rules. The article illustrates this system through Binance wallets and networks including Ethereum, Bitcoin, and Solana.

This design enables direct transfers but creates a difficult balance. Transactions can be followed through wallet addresses, allowing investigators and analytics firms to trace movement. Yet users can convert assets and route them through DeFi or instant exchanges. The FBI warned that such activity could obscure the funds’ origins and make recovery harder.