WASHINGTON (Web Desk) – The United States Federal Bureau of Investigation (FBI) has formally accused North Korea of carrying out a major cyberattack that resulted in the theft of more than $6 billion in virtual assets from Binance, the world’s largest cryptocurrency exchange.
In a statement issued on Saturday, October 31, the FBI said the theft occurred on or around October 29, 2026, identifying the operation as the work of North Korean malicious cyber actors operating under the name “TraderTraitor”.
The incident represents one of the largest cryptocurrency thefts recorded in the digital asset industry and has raised fresh concerns about the growing threat posed by sophisticated cybercriminal networks targeting international financial platforms.
According to the FBI, investigators have observed the attackers converting the stolen cryptocurrency primarily into Ethereum (ETH), a digital currency widely used for blockchain transactions and decentralised financial services.
The agency warned that the stolen assets were expected to undergo additional laundering stages through decentralised finance (DeFi) platforms and instant cryptocurrency exchange services in an effort to obscure their origins.
FBI urges cryptocurrency companies to block stolen funds
The FBI said it was working alongside the US Secret Service (USSS) and the Internal Revenue Service Criminal Investigation division (IRS-CI) to track the movement of the stolen assets and prevent further financial transfers.
The three agencies have urged cryptocurrency exchanges, blockchain infrastructure operators, decentralised finance platforms, digital asset service providers and blockchain analytics companies to identify and block transactions connected to the wallets used by the attackers.
The FBI has also published a list of cryptocurrency wallet addresses associated with the operation, including Ethereum, Bitcoin and Solana addresses.
The objective is to prevent criminals from transferring the stolen funds through different platforms or converting them into other digital currencies to make tracing more difficult.
The agency warned that transactions originating from or connected to the identified wallet addresses should be treated with caution.
It also encouraged private-sector organisations with relevant information to cooperate with investigators and report suspicious activity through appropriate channels.
The operation highlights the importance of cooperation between cryptocurrency businesses and government agencies in tracking digital assets that move across international blockchain networks.
North Korean group identified as TraderTraitor
The FBI identified the cyber operation as TraderTraitor, a name associated with malicious cryptocurrency-related activities attributed to North Korean actors.
Cybersecurity authorities have previously expressed concerns about North Korea-linked hacking operations targeting cryptocurrency exchanges, digital wallets and blockchain platforms.
Such operations are believed to provide an avenue for obtaining substantial financial resources through unauthorised access to digital assets.
Cryptocurrency transactions can be traced through publicly accessible blockchain records, but criminals may attempt to complicate investigations by moving funds through multiple wallets, exchange services and decentralised financial platforms.
The latest investigation demonstrates how quickly stolen digital assets can be moved across different blockchain networks after a major security incident.
Binance faces fresh questions over cryptocurrency security
The attack has placed renewed attention on the security of centralised cryptocurrency exchanges, which hold and manage digital assets on behalf of millions of customers.
Binance serves approximately 335 million registered users worldwide and maintains substantial amounts of cryptocurrency under custody.
A security incident of this scale raises questions about the protection of digital wallets, transaction authorisation systems, internal access controls and the ability of exchanges to respond to sophisticated cyberattacks.
Earlier, Binance said it would cover the financial impact of the incident and work with industry partners to recover or freeze affected assets.
The company’s response is intended to maintain customer confidence while investigations and recovery efforts continue.
The FBI’s latest announcement also reinforces the importance of identifying suspicious wallet transactions before stolen cryptocurrency can be transferred through additional platforms.
Cryptocurrency industry faces wider cyber threats
The Binance incident comes amid continuing concerns about cryptocurrency thefts and the use of digital currencies in international financial crime.
Blockchain technology allows transactions to take place across national borders, but criminals can attempt to exploit the speed and complexity of digital asset transfers to conceal the movement of illicit funds.
Security specialists have warned that cryptocurrency exchanges need stronger protective systems, regular security assessments and effective monitoring of unusual transactions.
The use of artificial intelligence and increasingly sophisticated cyber techniques has also increased the challenges facing companies responsible for protecting digital financial infrastructure.
Investigation and asset recovery continue
The FBI said it expected further attempts by the attackers to launder the stolen cryptocurrency through decentralised finance services and instant-swap platforms.
Authorities are therefore seeking cooperation from companies operating across the cryptocurrency ecosystem to identify suspicious transactions and prevent additional movement of the funds.
The investigation remains focused on tracing the stolen assets, identifying connected wallet addresses and disrupting the financial activities of the suspected North Korean cyber actors.
The case has become a major test of international cooperation in combating cryptocurrency-related cybercrime and protecting users of digital financial platforms.
