The FBI has attributed the theft of more than $6 billion in digital assets from cryptocurrency exchange Binance to TraderTraitor, a North Korean state-sponsored hacking group. The agency said the incident, which occurred around October 29, 2026, was the largest cryptocurrency heist on record.
In a security alert, the FBI identified TraderTraitor as a group also known as Lazarus Group, Jade Sleet and APT38. Blockchain intelligence companies TRM Labs and Chainalysis had previously linked the theft to the same operation.
According to Binance, the attackers gained access after compromising a DevOps engineer’s laptop. They then reached a service container and submitted unauthorized withdrawal transactions. Approximately $6.36 billion in cryptocurrency was moved across ten blockchains, with most of the funds transferred within about 20 minutes.
The FBI said TraderTraitor has mainly converted the stolen assets into Ethereum. The agency expects the group to continue laundering the funds through decentralized finance platforms and instant cryptocurrency swap services. U.S. authorities are asking exchanges, blockchain operators and other virtual asset service providers to block transactions associated with the laundering addresses.
The agency published 628 cryptocurrency addresses linked to the theft: 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address.
TraderTraitor has been linked to several other cryptocurrency thefts, including the $387.5 million Bitget theft in September 2026, the $280 million Drift attack in April 2026, the $1.5 billion Bybit heist in February 2025 and the $308 million DMM Bitcoin theft in May 2024.
North Korean hackers have also used a campaign known as Operation DreamJob, in which they pose as recruiters and contact software developers or cryptocurrency employees with fraudulent job offers. The DMM Bitcoin and Bybit incidents similarly involved compromising computers belonging to employees or developers with access to cryptocurrency infrastructure.
Binance said it planned to resume the first phase of withdrawals on November 1 between 06:00 and 09:00 UTC while continuing to restore services and cover the stolen assets. The exchange said it had covered approximately 95% of the affected amount, with the remaining 5% consisting of less-liquid tokens that it was still purchasing through market and over-the-counter channels.
Binance also said that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances were fully backed, while deposit services remained unaffected. The company stated that it would absorb the financial impact of the stolen funds rather than pass the losses on to users.
Sources: BleepingComputer.