FBI Blames North Korea's TraderTraitor for Record $6.3 Billion Binance Hack

The FBI has formally blamed North Korea for the largest cryptocurrency theft in history. In a statement issued on October 31, the bureau attributed the theft of more than $6 billion in virtual assets from Binance to TraderTraitor, a North Korean hacking operation it says was observed converting the stolen funds primarily into Ethereum, with further laundering expected through decentralised finance protocols and instant swap services. The bureau published an extensive list of wallet addresses linked to the operation and urged exchanges and DeFi platforms to block transactions touching them.

The scale is difficult to overstate. Binance puts the estimated impact at about $6.3 billion; blockchain intelligence firm TRM Labs counts roughly $6.36 billion moved across ten blockchains on October 29. The previous record, the $1.46 billion taken from Bybit in February 2025, was attributed to the same North Korean cluster. This theft is more than four times that size, executed in a single evening against the world's largest crypto exchange.

Binance's preliminary account of how it happened reads less like a break-in than a hijacking of trust. The company says a compromised DevOps engineer's laptop gave the attacker access to a service container, from which unauthorised withdrawal requests were submitted. TRM describes an Ethereum EIP-7702 authorisation that delegated a hot wallet's behaviour to malicious code, alongside ordinary signed transfers on other chains. Binance says it has found no evidence that any wallet private key leaked, which, if it holds, makes this a story about internal access controls rather than cryptography failing.

What has followed is a race, and it is the race that will decide how this story is remembered. About $2.85 billion to $3 billion of the stolen assets have already been frozen on-chain: Tether froze more than $1.55 billion in USDT, Circle more than $800 million in USDC, with Ripple, Arbitrum and Optimism also acting. But freezing only works where a central issuer holds a switch. The remainder, much of it now being converted into Ethereum, moves through systems designed to have no switch at all, and the FBI's warning about DeFi laundering is an admission that the second half of the recovery will be much harder than the first.

Binance, for its part, has moved fast to contain the damage to its own users. The exchange says it has set aside more than $6.34 billion of company funds, drawn from its Secure Asset Fund for Users, its futures insurance fund and its corporate treasury, and has already replaced roughly 95% of the affected assets, with the remaining 5% consisting of less liquid tokens it is still buying through market and over-the-counter channels. Withdrawals began resuming progressively on November 1, starting with Bitcoin, Ethereum, BNB Chain, Solana, Tron and the XRP Ledger, and a full proof-of-reserves snapshot is promised by Monday. Whether that timetable holds, and whether the reserves statement survives independent scrutiny, is the test users can actually run themselves.

I keep returning to the asymmetry at the heart of this. A state-backed hacking operation can steal $6 billion in an evening, and the defence depends on a patchwork of private companies choosing, one by one, to freeze what they can reach. The stablecoin issuers moved within hours, and that speed is genuinely impressive. But the assets that cannot be frozen are already being washed through the permissionless machinery that crypto built precisely to resist intervention. The question now is not whether Binance's users are made whole — the company has committed enough of its own money that they probably will be — but how much of the loot the freezers can catch before the launderers finish converting it into something no one can stop. That contest is still running, and its outcome will shape how exchanges, issuers and regulators think about crypto security for years.