In brief
On October 29, 2026 the FBI accused North Korean authorities of a $6.3 billion hack of Binance, citing a state‑backed group known as TraderTraitor. Binance has reimbursed 90 % of the stolen assets and will use half of its Secure Asset Fund for Users to cover the rest. A U.S. blockchain intelligence firm, TRM, also points to a North Korean hacking unit as the likely culprit. The true evidence, the laundering pathway, and individual culpability remain unknown.
On October 29, 2026, the U.S. Federal Bureau of Investigation announced that it had charged North Korean authorities with orchestrating a $6.3 billion cyber‑attack on the Binance cryptocurrency exchange.
According to the FBI press release, the attack began around that date and resulted in the theft of virtual assets valued at more than $6 billion.
The bureau says the theft was carried out by a state‑backed hacking group identified as TraderTraitor, a unit known from past investigations to operate in North Korea. The hackers were said to convert the stolen assets primarily into the Ethereum cryptocurrency and then further launder them using DeFi and instant‑swap services.
Binance has confirmed the loss. The platform stated it has already reimbursed 90 % of the stolen funds and will allocate 50 % of the Secure Asset Fund for Users to cover the remaining losses.
A U.S.‑based blockchain intelligence firm, TRM, has weighed in, saying a North Korean hacking unit was likely responsible for the theft. News outlets in Kansas City, Orlando, and other markets reported this view in 22‑hour segments.
TRM’s commentary is not a formal accusation like the FBI’s; the firm has not released forensic details or evidence that explicitly ties the stolen assets to the TraderTraitor group.
The FBI’s statement does not cite evidence publicly, and TRM has not provided a technical breakdown of how the assets were moved or laundered. The specific methods used to convert the virtual assets into Ethereum and the subsequent flows through DeFi are still unconfirmed.
Uncertainties remain regarding the specific evidence supporting the FBI’s accusation, the exact mechanisms the hackers used to move and launder the assets, the identity of individual operators within the alleged TraderTraitor group, and the extent to which Binance’s compensation plan fully restores affected customers.
