In brief
The FBI announced that North Korean operatives carried out a $6.36bn cryptocurrency theft from Binance, converting the loot into Ethereum and other assets. The operation, dubbed TraderTraitor, prompted the FBI, Secret Service and IRS to urge exchanges to block related wallet addresses. The hack followed a similar Bybit incident and was flagged by blockchain intelligence firm TRM Labs.
On October 31, 2026, the U.S. Federal Bureau of Investigation released a cyber alert saying that North Korean hackers had stolen more than $6 billion in cryptocurrency from Binance, the world’s biggest crypto exchange, on roughly October 29, 2026.
The FBI identified the attackers as part of a state‑sponsored campaign called TraderTraitor, a moniker it has used before to describe similar thefts, noting that the operation is part of a broader campaign of state‑backed cybercrime that aims to fund North Korea’s budget.
According to the agency, the thieves moved the stolen coins mainly into Ethereum and other digital wallets, and were expected to launder the proceeds through decentralized finance platforms and fast‑swap exchanges.
The FBI, the Secret Service and the IRS Criminal Investigation Division urged all virtual‑asset service providers—including crypto exchanges, blockchain operators and analytics firms—to block transactions that involve wallet addresses linked to the North Korean actors, as regulators push for stronger anti‑money‑laundering oversight in the crypto market.
Earlier in the week, blockchain‑analytics company TRM Labs had already attributed the $6.36 billion loss to TraderTraitor and noted similarities with a recent hack of Bybit, another major exchange. TRM Labs’ analysis found that the stolen assets were rapidly moved into Ethereum and other tokens using automated trading bots.
The case underscores how global finance faces risks from sophisticated cyberattacks and the need for coordinated regulatory and technical responses. Authorities warn that if vaults are not fenced off, the illicit funds could continue to circulate, eroding trust in digital assets.
