Binance's $6.3 billion crypto heist: What to know about TraderTraitor, North Korea's hacking group accused of the hack

The Federal Bureau of Investigation (FBI) has blamed a North Korean hacking group, known as TraderTraitor, for the theft of more than $6.3 billion in virtual assets from cryptocurrency exchange Binance, in what analysts believe could be one of the biggest financial heists ever.

The FBI said on Saturday that TraderTraitor was responsible for the attack, which took place on or around October 29, 2026. The bulk of the theft reportedly unfolded in approximately 20 minutes, according to US blockchain analysis firms TRM Labs and Chainalysis.

The incident has put the spotlight on North Korea's alleged use of cyber operations to steal cryptocurrency and generate revenue amid extensive international sanctions imposed on the country over its nuclear and missile programmes.

Quick answers to key questions

•5

QUESTIONS

TraderTraitor is the name given to a North Korean state-sponsored cyber unit accused of cryptocurrency thefts and laundering stolen digital assets. The FBI blamed it for stealing more than $6.3 billion in virtual assets from Binance.

Binance’s co-CEO described the breach as a complex attack involving a compromised laptop and malicious software. The malware was allegedly designed to erase evidence, and the exact method used to access Binance’s systems remains unclear.

The FBI said TraderTraitor was converting stolen assets into ether and warned that the group could use decentralised finance platforms and instant swap services to launder them. Blockchain firms reported rapid transfers and signs of automation.

Binance said it would bear the financial impact and set aside about $6.34 billion to cover the stolen assets. It used funds from its SAFU, Futures Insurance Fund and corporate treasury to buy replacement tokens.

Yes. TraderTraitor has also been blamed for the theft of about $1.5 billion in cryptocurrency from Bybit in February 2025.

Binance, the world's largest cryptocurrency exchange by daily trading volumes, has said it will bear the financial impact of the theft. The company said it had covered around 95% of the stolen assets by purchasing replacement tokens and had resumed withdrawals in phases on Sunday.

What is TraderTraitor?

TraderTraitor is the name given to a North Korean state-sponsored cyber unit accused of carrying out cryptocurrency thefts and laundering stolen digital assets.

The FBI identified the group as responsible for the Binance hack, saying law enforcement agencies had observed its members converting stolen assets into ether, the cryptocurrency associated with the Ethereum blockchain.

The agency warned that the stolen funds could undergo further laundering through decentralised finance (DeFi) platforms and instant swap services. It also urged private-sector organisations to block transactions involving cryptocurrency addresses being used by the group.

TraderTraitor is believed to be associated with North Korea's Lazarus Group, a hacking organisation that has been linked to several high-profile cyberattacks over the years.

What is the Lazarus Group's connection with TraderTraitor?

The Lazarus Group is a North Korea-linked hacking organisation that has been accused of conducting cyberattacks against businesses, financial institutions and government organisations.

The group gained international notoriety in 2014 when it was accused of hacking Sony Pictures Entertainment. The attack was widely linked to the release of The Interview, a comedy film that mocked North Korean leader Kim Jong Un.

Lazarus has also been linked to major cryptocurrency thefts, with cyber investigators alleging that North Korean-linked hackers have increasingly targeted digital asset platforms to obtain funds.

TraderTraitor is believed to be part of this wider network of North Korean cyber operations.

TraderTraitor accused of Bybit hack before Binance theft

TraderTraitor has also been blamed for the theft of approximately $1.5 billion in cryptocurrency from Dubai-based exchange Bybit in February 2025.

The group is now accused of carrying out the much larger Binance attack, which involved the theft of more than $6.3 billion in virtual assets.

The two incidents have renewed concerns about the ability of North Korean-linked cyber groups to target major cryptocurrency exchanges and move stolen funds across digital asset networks.

According to TRM Labs, attackers stole around $2.9 billion worth of cryptocurrency across nearly 150 attacks last year, underlining the growing scale of security threats facing the digital asset industry.

How did TraderTraitor allegedly steal $6.3 billion from Binance?

The Binance breach has been described by the exchange's co-CEO Richard Teng as a complex attack involving a compromised laptop and malicious software.

The malware was allegedly designed to delete evidence of its activity, making it more difficult for investigators to trace the intrusion and establish how the attack unfolded.

How is Binance recovering the stolen cryptocurrency?

Binance has said it will absorb the financial impact of the theft rather than pass the losses on to customers.

The exchange said it had set aside approximately $6.34 billion in company funds to cover the stolen assets. It also said it had recovered or located around $3 billion of the affected assets with the help of industry partners as of Friday.

The company used funds from its Secure Asset Fund for Users (SAFU), Futures Insurance Fund and corporate treasury to purchase replacement tokens.

Binance said it had covered around 95% of the stolen assets, while the remaining portion consisted of less liquid cryptocurrencies that could take longer to source in the required quantities.

The exchange also began reopening withdrawals in phases on Sunday, initially restoring access to 15 tokens, including Bitcoin, Ether, Dogecoin and certain USDC and USDT stablecoin networks.

However, the attack triggered an initial surge in customer withdrawals. DefiLlama reported that Binance recorded more than $3.5 billion in net outflows on Sunday. The exchange said withdrawal activity was subsequently stabilising.

Trump questions North Korea's involvement

While the FBI has directly attributed the Binance theft to North Korea's TraderTraitor unit, US President Donald Trump has expressed uncertainty over Pyongyang's involvement.

"We don't know if it's North Korea — but if it is, we'll talk to North Korea about it," Trump told reporters on Saturday.