FBI Blames North Korean Hackers for $6.3 Billion Binance Crypto Theft

The Federal Bureau of Investigation has publicly linked a massive cryptocurrency theft to actors tied to North Korea, saying the scheme siphoned roughly $6.3 billion from the Binance exchange on Oct. 29. The bureau identified the operation by the internal code name "TraderTraitor" and said the perpetrators moved the stolen assets into Ethereum before preparing additional transactions.

According to the FBI, the attackers exploited a vulnerability in Binance's platform that allowed them to convert a wide array of tokens into Ethereum, a more liquid and widely traded digital currency. By funneling the loot into Ethereum, the thieves could obscure the trail and facilitate rapid resale on a variety of exchanges.

North Korea’s cyber‑warfare unit, commonly referred to as the Lazarus Group, has a documented history of targeting cryptocurrency platforms to raise cash for the regime’s sanctioned‑evasion activities. Past incidents include the 2019 theft of $40 million from the Japanese exchange Coincheck and a 2021 attack on the crypto‑lending platform Poly Network that netted close to $600 million. The new Binance breach, if confirmed, would dwarf those earlier operations and underscore the growing sophistication of state‑backed cybercriminal campaigns.

Binance, the world’s largest crypto exchange by trading volume, has not released detailed technical information about the breach but confirmed that it is working with law‑enforcement agencies worldwide to trace the funds. The company said it had temporarily halted certain trading functions on the affected accounts and that users whose assets were impacted would be notified in accordance with regulatory requirements.

The FBI’s announcement arrives amid heightened scrutiny of the cryptocurrency sector’s vulnerability to large‑scale thefts and money‑laundering schemes. Regulators in the United States and abroad have been pushing for stricter compliance standards, and the incident may accelerate calls for mandatory reporting of suspicious transactions and more robust security audits for exchanges. While the investigation is ongoing, the bureau indicated that it continues to monitor the converted Ethereum for signs of further movement, suggesting that additional illicit activity could follow the initial heist.