FBI Blames North Korea for Massive Crypto Heist at Binance

Federal law enforcement agencies have officially pinned a record-breaking digital asset heist on a state-sponsored hacker collective operating out of North Korea. According to an official public statement released by the Federal Bureau of Investigation, the threat group designated as TraderTraitor orchestrated the massive security breach that drained roughly $6.7 billion in virtual currencies from cryptocurrency exchange Binance.

The investigation reveals that the cyberattack, which took place on or around October 29, 2026, involved sophisticated infiltration methods. Investigators noted that a DevOps engineer working for the exchange suffered a compromised laptop, which inadvertently granted unauthorized entry into a service container. The attackers utilized this access to push unauthorized withdrawal transactions spanning ten different blockchain networks, including Bitcoin, Ethereum, Solana, XRP, and Arbitrum.

Security researchers and federal authorities have long tracked TraderTraitor as a specialized subunit of the broader Lazarus Group cybercriminal organization. This state-backed syndicate frequently utilizes social engineering campaigns, including elaborate fake job recruitment schemes like Operation DreamJob and Contagious Interview, to target software developers, blockchain programmers, and technical professionals across Western industries.

Following the unauthorized transfers, the perpetrators began rapidly laundering the stolen capital. Federal agencies, working alongside partners like the USSS and IRS-CI, observed the hackers converting the pillaged assets primarily into Ethereum before funneling them through decentralized finance protocols and instant swap services to obscure the paper trail. The FBI has released a comprehensive directory of wallet addresses linked to the crime, urging blockchain analytics firms, decentralized exchange operators, and virtual asset service providers to blacklist any transactions originating from these sources.

Despite the unprecedented scale of the breach, exchange leadership moved quickly to contain the fallout by temporarily freezing deposits and withdrawals. Operations have since resumed, and corporate reserves covered the entirety of the missing exchange funds rather than consumer accounts, which remained isolated behind platform security reserves. Representatives for the North Korean government have not issued a response to the formal attribution.