North Korea Linked to Historic $6B Binance Heist

​WASHINGTON — Federal law enforcement agencies have officially pinned the blame for the largest digital currency heist in history on the state-sponsored North Korean hacking collective known as “TraderTraitor”.

​The Federal Bureau of Investigation (FBI), acting in coordination with the United States Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI) division, announced that the group orchestrated the staggering theft of more than $6 billion in virtual assets from global cryptocurrency exchange Binance on or around October 29, 2026.

​A Catastrophic Breach and Rapid Response

​The unprecedented cyberattack shattered previous records, dwarfing past digital thefts. Blockchain intelligence firms and security analysts reported that the perpetrators siphoned funds across multiple blockchains in a matter of minutes, exploiting hot wallet infrastructure.

​In the wake of the breach, Binance temporarily halted trades and suspended customer withdrawals as panic rippled through broader financial markets, causing Bitcoin to slide and tech-adjacent stocks to dip. However, exchange executives moved swiftly to mitigate total devastation. Cooperation between major stablecoin issuers, blockchain networks, and security protocols allowed authorities and platforms to freeze roughly $2.7 billion to $3 billion of the stolen funds. Furthermore, Binance leadership announced they have successfully replenished 90% of the missing capital using corporate reserves and insurance funds to guarantee that everyday users are fully protected from financial losses.

​The Laundering Playbook

​According to federal advisories, the threat actors behind TraderTraitor—widely considered an arm or affiliate of the notorious Lazarus Group—have begun funneled portions of the un-frozen loot primarily into Ethereum (ETH).

ADVERTISEMENT

​Investigators warn that the regime is poised to cycle these holdings through a complex web of decentralized finance (DeFi) platforms, cross-chain bridges, and instant swap services. This multi-tiered laundering strategy is designed to obfuscate the origin of the capital before converting it into sovereign fiat currencies to fund the isolated nation’s state programs.

​Industry-Wide Alert Issued

​With billions still dangling in hacker-controlled wallets, US intelligence and law enforcement are rallying the global private sector to construct a digital blockade.

​Authorities have issued a direct urgent appeal to:

• ​THORNode and RPC node operators

• ​Instant exchanges and DeFi protocols

• ​Blockchain analytics firms and virtual asset service providers (VASPs)

​Firms are instructed to immediately halt and flag any inbound or outbound transactions tied to specific wallet addresses flagged by the FBI. A comprehensive, continuously updated ledger of illicit addresses linked to the TraderTraitor network has been published via the FBI Official Cyber Division Alert Portal.

​The FBI asks anyone possessing supplementary intelligence regarding the movement of the funds or the actors involved to submit tips directly through the Internet Crime Complaint Center at ic3.gov or contact local field offices.