North Korea linked to massive Binance crypto heist

The FBI says malicious actors connected to North Korea stole more than $6 billion in virtual assets from Binance customers. The alleged theft happened on or about October 29, 2026. The FBI labels this specific North Korean cyber activity “TraderTraitor.” The claim matters because it links a huge cryptocurrency theft to a state-associated hacking operation.

The agency says TraderTraitor actors took customer assets and began converting them, primarily into Ethereum. That conversion may help prepare the stolen funds for later laundering. The FBI says the actors were also preparing to use DeFi and instant-swap services. These steps can move assets through different crypto services before further laundering stages.

The FBI released the attribution with partners at the USSS and IRS-CI, but offered few other details or evidence. Binance froze withdrawals immediately after the hack, then reopened them. The FBI says it observed activity connected to the hack, while the stolen assets remain subject to further laundering efforts.

Binance is the cryptocurrency exchange identified in the report as the platform whose customers were affected. The source does not provide a formal definition, but an exchange generally acts as a marketplace for digital assets. It connects users who want to trade cryptocurrencies and provides accounts or related services for holding them.

An exchange can process trades, record balances, and manage customer withdrawals. In this case, the alleged attackers stole virtual assets from Binance customers. The exchange then froze withdrawals after the incident. That action temporarily stopped customers from moving funds out while the situation was addressed.

Binance later reopened customer withdrawals. That means customers could again request access to their assets through the platform. Reopening does not change the FBI’s attribution or erase the reported theft. It indicates that the immediate withdrawal restriction had ended, while investigators and partners continued observing the stolen assets’ movement.

The alleged theft was enormous. The FBI describes more than $6 billion in stolen virtual assets and identifies the amount elsewhere as $6.3 billion. The affected assets were held by customers of Binance, the cryptocurrency exchange named in the report. This scale makes the incident significant beyond a single account or isolated transaction.

The reported loss concerns crypto assets, not a stated amount of cash removed from bank accounts. The FBI says malicious actors from North Korea stole those virtual assets from Binance customers. It also says the actors began converting the stolen assets primarily into Ethereum. That activity indicates the attackers were already moving and restructuring the funds after the theft.

The exact breakdown of assets is not provided. The FBI also offered few details or evidence about the operation. Still, the reported figure shows the size of the alleged attack, while the customer impact explains why Binance froze withdrawals immediately afterward. Withdrawals were later reopened.

The FBI’s attribution rests on activity it connected to North Korean actors. It calls the operation “TraderTraitor” and says malicious actors from North Korea were responsible for stealing the virtual assets. The agency released the information with the USSS and IRS-CI, which were identified as partners in the statement.

The clearest observation described is what happened after the theft. The FBI and its partners observed TraderTraitor actors converting stolen assets primarily into Ethereum. They also observed activity suggesting the assets were being prepared for further laundering through DeFi and instant-swap services. Those transaction patterns helped connect the activity to the named operation.

The public statement remains limited. It says the FBI offered few other details or evidence, so it does not explain the full investigation, technical indicators, or attribution process. The reported observations support the agency’s claim, but the source does not provide enough information to independently assess every step behind that conclusion.

Binance froze customer withdrawals in the immediate aftermath of the hack. The source does not state every operational reason, but the timing shows the restriction followed the reported theft. Freezing withdrawals can temporarily prevent funds from leaving the platform while an exchange responds to suspicious activity and assesses customer accounts.

The concrete change was a pause followed by restoration. Binance reopened customer withdrawals after freezing them. For customers, reopening means the withdrawal function became available again, allowing them to request transfers of their crypto assets from the exchange. It does not mean the alleged stolen funds were recovered or that the investigation was finished.

The FBI says TraderTraitor actors were still converting stolen assets and preparing them for further laundering. That means reopening withdrawals occurred alongside continuing scrutiny of the stolen funds. Customers regained normal access, while investigators and partner agencies continued tracking the reported post-theft activity.

Crypto laundering means trying to disguise the origin and movement of stolen digital assets. Converting tokens into Ethereum changes the asset type. Moving funds through DeFi and instant-swap services can add more transactions and services between the theft and later destinations. The source describes these actions as preparation for further laundering stages.

For example, the FBI observed TraderTraitor actors converting stolen assets primarily into Ethereum. The agency expected the assets to be further laundered through DeFi and instant-swap services. These mechanisms can exchange one digital asset for another or move assets through blockchain-based financial services without the same single platform handling every step.

The report does not say that every conversion completed successfully or identify the final recipients. It says the actors were preparing the funds for additional laundering. That matters because each new conversion or service can complicate the trail investigators follow, even though blockchain transactions can remain visible. The FBI and its partners were observing this activity.

A blockchain is a shared digital ledger that records cryptocurrency transactions. A wallet is an address, usually controlled through private credentials, that can receive or send assets. Decentralized finance, or DeFi, provides blockchain-based financial services without one central operator controlling every transaction. These are standard definitions; the source only mentions Ethereum, DeFi, and instant-swap services.

The public transaction record can help investigators follow where stolen assets go. In this case, the FBI and its partners observed TraderTraitor actors converting stolen assets primarily into Ethereum. Yet tracing a movement is not the same as recovering the funds. Wallet addresses may not directly reveal the people controlling them, and assets can move through multiple wallets, swaps, and services.

The FBI says the actors were preparing the funds for further laundering. That can make the trail more complicated and may place assets beyond an exchange’s immediate control. The report does not describe any recovery. It shows the central tension: blockchain activity can leave a visible trail while practical recovery remains difficult.