FBI Blames North Korea for $6.3bn Binance Theft
The FBI has formally blamed North Korean state-sponsored hackers for stealing more than $6 billion from Binance, the largest cryptocurrency heist on record. It names the group TraderTraitor and says the theft took place on or around 29 October 2026.
The FBI alert, dated 31 October and issued with the US Secret Service and IRS Criminal Investigation, confirms what blockchain analysts at TRM Labs and Chainalysis had said a day earlier. Binance puts the loss at about $6.3 billion. TRM Labs counted about $6.36 billion.
What happened
According to TRM Labs, funds left Binance wallets on ten blockchains, most of them in about 20 minutes starting at 20:05 UTC on 29 October.
Binance's early investigation suggested the incident may have started with a compromised laptop belonging to a DevOps engineer. That gave an attacker access to a service container, from which unauthorised withdrawals were submitted. Binance later said it had found additional points of breach, so the full cause is still being investigated.
Laundering and the FBI's request
The FBI says it has seen TraderTraitor converting the stolen assets mainly into Ethereum, and expects further laundering through decentralised finance platforms and instant swap services.
Together with the Secret Service and IRS Criminal Investigation, it published 628 addresses linked to the theft: 608 on Ethereum, 19 on Bitcoin and one on Solana. It asked node operators, exchanges, DeFi services and analytics firms to block transactions involving them.
Who is TraderTraitor
TraderTraitor is a North Korean hacking operation linked to the wider Lazarus ecosystem and also tracked by Microsoft as Jade Sleet. It has a long record of attacks on crypto companies, including:
- Bitget: $387.5 million, September 2026
- Drift: $280 million, April 2026
- Bybit: $1.5 billion, February 2025
- DMM Bitcoin: $308 million, May 2024
The group is known for fake job offers, often called Operation DreamJob, aimed at developers and crypto staff. In the DMM Bitcoin case, an attacker posing as a LinkedIn recruiter tricked an employee of wallet provider Ginco into running a malicious Python script presented as a pre-employment test. The Bybit theft began with the compromise of a Safe{Wallet} developer's machine, which let the attackers alter a legitimate transfer.
The FBI has not said, in the reporting we reviewed, how the Binance engineer's laptop was compromised.
Binance's response
Binance says deposits were not affected and that it will absorb the loss itself, so customers do not pay. It says it replaced about 90% of the stolen amount with company funds by Saturday, and CEO Richard Teng said about 95% had been replenished as withdrawals began reopening.
What our data shows
At the time of writing, our monitoring shows 558 phishing hostnames using the Binance name, plus 41 lookalike domains registered in the last 15 days.
Binance ranks 23rd among the 579 brands we monitor.
Most of these addresses end in .com, and "support" is the word they add most often to look official.
See the live numbers for Binance in our live data.
binanceevn[.]comcancel-binance[.]comdisable-binance[.]comsupport--binance-us[.]webflow[.]ioDefanged (dots in brackets) so they cannot be clicked. Never visit these addresses.What customers should do
Big incidents bring a wave of scams. Treat any message offering to "recover", "verify" or "unlock" funds as a scam unless you can confirm it inside the official Binance app. Open Binance only through that app or by typing the address yourself, and never share passwords, login codes or wallet recovery phrases.
Frequently asked questions
Who does the FBI hold responsible for the Binance theft?
North Korean state-sponsored hackers it tracks as TraderTraitor, an operation linked to the Lazarus ecosystem.
How did the attackers get in?
Binance's early investigation points to a compromised DevOps engineer's laptop, which gave access to an internal service container that submitted unauthorised withdrawals. Binance has since said it found additional points of breach.
Will Binance users lose money?
Binance says no. It says it will absorb the loss and that deposits were not affected.
Sources
- BleepingComputer · 1 Nov 2026
- SecurityWeek · 2 Nov 2026
- Decrypt · 2 Nov 2026
PhishPin writes its own analysis from the facts in this reporting and links to the original coverage.
Is your brand being impersonated?
PhishPin finds lookalike domains, fake profiles and phishing kits that copy your brand - and gets them taken down. Get a confidential 24-hour audit.
Get my free audit
