FBI says North Korean unit ‘TraderTraitor’ stole $6.3 Billion from Binance

Published on 1 November 2026 – 9:15 GMT+1

The U.S. Federal Bureau of Investigation (FBI) has blamed a North Korean cyber unit for a massive breach of the Binance cryptocurrency exchange that occurred earlier this week.

The agency refers to the operation as “TraderTraitor,” reporting that the attackers accessed Binance’s hot wallets and siphoned off roughly $6.3 billion in digital assets on or about October 29, 2026. In a statement released on Saturday, the FBI identified the Democratic People’s Republic of Korea (North Korea) as responsible for the theft.

According to the FBI, the stolen funds have been converted into Ethereum and are expected to be further laundered through decentralized finance (DeFi) platforms and instant‑swap services. The bureau’s assessment ties the incident to a broader pattern of North Korean‑sponsored cyber‑crime.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) classifies the group behind the attack as the “TraderTraitor” collective, a state‑sponsored actor linked to cryptocurrency thefts since at least 2020. CISA believes the unit is part of the larger Lazarus Group, which has conducted numerous spear‑phishing campaigns and malware attacks against blockchain and crypto‑industry targets.

Following the breach, Binance halted deposits and withdrawals while its security team performed thorough checks, froze affected funds, and collaborated with law‑enforcement agencies. The exchange has now recouped about 90 % of the stolen assets and is gradually resuming withdrawals “in phases.”

Co‑CEO Richard Teng said the company will cover any remaining losses using its own resources, emphasizing that user assets remain secure. “Your assets are safe,” he added in a video statement posted on social media.

The episode highlights the escalating risk posed by state‑backed cyber‑crime groups targeting the cryptocurrency sector and underscores the need for heightened security measures across digital‑asset platforms.

Source link