The US Federal Bureau of Investigation (FBI) has released an official statement accusing the Democratic People's Republic of Korea (DPRK) of stealing over 6 billion US dollars in virtual assets from the Binance cryptocurrency exchange. According to the agency's press service, the attack took place around October 29, 2026. This is one of the largest public accusations against North Korean cybercriminals in the digital asset sector.
Official Accusation and the TraderTraitor Group
The FBI statement indicates that hackers from the North Korean group "TraderTraitor" are responsible for the exchange breach. Bureau personnel reportedly observed the perpetrators converting the stolen assets primarily into Ethereum (ETH) blockchain tokens. The agency added that these assets are expected to be laundered through decentralized finance (DeFi) services and instant exchange platforms, preparing them for further stages of legalization.
Scale of the Theft and Exchange Actions
As previously reported, on October 29, hackers withdrew nearly 3 billion dollars worth of cryptocurrency from Binance's hot wallets. Some of the stolen funds have already been frozen, and platform users have been promised full compensation. Independent analysts had previously pointed to a link between the attack and the DPRK: data from TRM Labs showed that the world's largest cryptocurrency exchange had been targeted by cyberattacks from North Korea.
US Response and Address Blocking
The US has called on virtual asset service providers (VASPs) to block transactions involving addresses used by the hackers. To facilitate this, the FBI published a list of the relevant crypto addresses on its official website so that market participants can identify and track the movement of the stolen funds.
Context: A Consistent Pattern of DPRK Attacks on Crypto Exchanges
The current incident fits into a broader picture: media and analytical companies have previously reported multiple cyberattacks by DPRK hackers on Binance. Notably, back in February 2025, the FBI accused North Korean hackers of stealing 1.5 billion dollars from a cryptocurrency exchange—a separate, preceding incident that at the time was considered one of the largest digital asset thefts. The combination of these events confirms a consistent pattern in which North Korean groups deliberately target crypto platforms, convert their loot into liquid assets, and use DeFi tools for laundering.
For the digital asset market, the FBI's statement means increased pressure on the infrastructure through which the hackers' transactions pass, and likely new rounds of address freezes. At the same time, the final legal qualification of the events and the responsibility of specific individuals remain subjects of ongoing investigation and public accusations by US authorities.
