The culprit now has an official name. On Saturday the FBI said North Korea was behind this week’s raid on Binance, the biggest crypto trading platform on the planet, in which more than $6 billion in digital assets vanished. The bureau linked the attack to a state-backed crew it tracks as “TraderTraitor”, the same outfit it blamed for the $1.5 billion Bybit theft in 2025.
The scale is hard to overstate. Blockchain analytics firm Elliptic puts the haul at roughly $6.43 billion, drained from Binance hot wallets on October 29 across 11 blockchains in about three hours. That is more than four times the Bybit total, and Elliptic describes it as very probably the largest single theft of any kind on record. Chainalysis, another tracing company, reached the same verdict about who did it within hours of the breach.
Investigators had several clues. Some of the stolen coins were mixed in the same wallets as money taken from the Bitget exchange in September, a hack already linked to Pyongyang. The attackers also behaved like earlier North Korean teams: months of preparation, staff targeted as a way in, and automated laundering scripts that kept moving funds day and night. Binance first pointed to a compromised engineer’s laptop but later said the operation had several entry points and involved more than a single intruder.
A large share may still be recovered. Because much of the loot sat in stablecoins whose issuers can freeze tokens, about $2.85 billion, or 44 percent, has been locked or seized, according to Elliptic. The hackers have been racing to swap the remainder into Ether, which cannot be frozen.
The FBI published the wallet addresses in use and urged exchanges, node operators and DeFi services to refuse any related transactions. Washington has long argued that crypto theft helps fund North Korea’s weapons programmes. On Sunday the exchange let customers take out funds again, beginning with Bitcoin transfers.
