The Federal Bureau of Investigation (FBI) has attributed a massive cyberattack on Binance, the world's largest cryptocurrency exchange, to North Korean hackers. According to the agency, the hackers stole over $6 billion in virtual assets from Binance on or around October 29, 2026. The FBI disclosed this information in a statement on Saturday, two days after the cyberattack disrupted operations on the cryptocurrency trading platform.
The FBI identified the cyber operation as "TraderTraitor", a malicious hacking activity linked to North Korean actors. Investigations by the FBI, alongside the United States Secret Service and the Internal Revenue Service Criminal Investigation, showed that the hackers had been converting the stolen assets primarily into Ethereum. The agency warned that the hackers were expected to further launder the stolen funds through decentralised finance (DeFi) platforms and instant swap services.
The cyberattack on Binance occurred on October 29, with hackers reportedly stealing about $6.3 billion from the platform. However, the cryptocurrency exchange assured customers that their assets were safe and that they would not suffer any financial losses from the incident, citing sufficient funds set aside to cover the losses. The incident highlights the vulnerability of cryptocurrency exchanges to cyberattacks and the need for robust security measures.
The FBI urged members of the public across the world to provide any information that could assist its investigation into the TraderTraitor cyber operation. The agency reaffirmed its commitment to protecting the virtual asset ecosystem by identifying, mitigating, and disrupting North Korea's cybercrime operations and cryptocurrency theft activities. This incident marks a significant escalation in the global fight against cybercrime.
As part of its efforts to disrupt the hackers' operations, the FBI published cryptocurrency wallet addresses on the Ethereum, Bitcoin, and Solana blockchains that it said were holding or had previously held assets stolen in the attack. The addresses are operated by or closely connected to North Korean TraderTraitor actors. This move aims to freeze the stolen assets and prevent further laundering.
The international community has been alerted to the risks associated with the TraderTraitor cyber operation, and cryptocurrency exchanges and investors are advised to exercise caution when dealing with virtual assets. The incident underscores the need for collaboration and information sharing between law enforcement agencies and the private sector to combat cybercrime.
The FBI's investigation into the TraderTraitor cyber operation is ongoing, and the agency is working closely with its partners to bring the perpetrators to justice. The incident serves as a reminder of the evolving nature of cyber threats and the importance of robust security measures to protect virtual assets.
Key points
- North Korean hackers stole over $6 billion from Binance.
- The FBI identified the cyber operation as "TraderTraitor".
- The hackers converted stolen assets primarily into Ethereum.
