--- title: "FBI Accuses North Korean Hackers of Stealing Over $6B from Binance" description: "The FBI accused the North Korean group TraderTraitor of stealing over $6 billion from Binance. Some funds have been converted to Ethereum, and a list of hacker addresses has been published for blocking." date: 2026-10-31T22:34:33.310Z lang: en url: https://xab.info/en/posts/fbi-accuses-north-korean-hackers-binance tags: [binance, fbi, north-korea, cyberattack, cryptocurrency, ethereum] author: "Alexander Buran" publisher: "XAB.info" --- # FBI Accuses North Korean Hackers of Stealing Over $6B from Binance ![A hooded hacker at a computer with a smartphone hacking the Binance cryptocurrency exchange.](https://xab.info/media/2026/10/31/fbr-obyvinilo-severnokoreyskih-hakerov-v-kradhe-s-binance/fbr-obyvinilo-severnokoreyskih-hakerov-v-kradhe-s-binance-1.webp) ## Key Points - The FBI accused the DPRK and the TraderTraitor group of stealing over $6 billion from Binance around October 29, 2026. - Hackers converted the stolen assets primarily into Ethereum; laundering is expected via DeFi and instant exchange services. - On October 29, nearly $3 billion was withdrawn from Binance hot wallets; some funds were frozen and users promised full reimbursement. - The FBI published a list of hacker addresses and urged virtual service providers to block related transactions. The US Federal Bureau of Investigation (FBI) has released an official statement accusing the Democratic People's Republic of Korea (DPRK) of stealing over 6 billion US dollars in virtual assets from the Binance cryptocurrency exchange. According to the agency's press service, the attack took place around October 29, 2026. This is one of the largest public accusations against North Korean cybercriminals in the digital asset sector. ### Official Accusation and the TraderTraitor Group The FBI statement indicates that hackers from the North Korean group "TraderTraitor" are responsible for the exchange breach. Bureau personnel reportedly observed the perpetrators converting the stolen assets primarily into Ethereum (ETH) blockchain tokens. The agency added that these assets are expected to be laundered through decentralized finance (DeFi) services and instant exchange platforms, preparing them for further stages of legalization. ### Scale of the Theft and Exchange Actions As previously reported, on October 29, hackers withdrew nearly 3 billion dollars worth of cryptocurrency from Binance's hot wallets. Some of the stolen funds have already been frozen, and platform users have been promised full compensation. Independent analysts had previously pointed to a link between the attack and the DPRK: data from TRM Labs showed that the world's largest cryptocurrency exchange had been targeted by cyberattacks from North Korea. ### US Response and Address Blocking The US has called on virtual asset service providers (VASPs) to block transactions involving addresses used by the hackers. To facilitate this, the FBI published a list of the relevant crypto addresses on its official website so that market participants can identify and track the movement of the stolen funds. ### Context: A Consistent Pattern of DPRK Attacks on Crypto Exchanges The current incident fits into a broader picture: media and analytical companies have previously reported multiple cyberattacks by DPRK hackers on Binance. Notably, back in February 2025, the FBI accused North Korean hackers of stealing 1.5 billion dollars from a cryptocurrency exchange—a separate, preceding incident that at the time was considered one of the largest digital asset thefts. The combination of these events confirms a consistent pattern in which North Korean groups deliberately target crypto platforms, convert their loot into liquid assets, and use DeFi tools for laundering. For the digital asset market, the FBI's statement means increased pressure on the infrastructure through which the hackers' transactions pass, and likely new rounds of address freezes. At the same time, the final legal qualification of the events and the responsibility of specific individuals remain subjects of ongoing investigation and public accusations by US authorities. ## Fact-Check & Sources - [ФБР обвинила хакеров Северной Кореи в хищении 6 млрд долларов с Binance](https://www.rbc.ua/ukr/news/fbr-zvinuvatila-hakeriv-pivnichnoyi-koreyi-1793485413.html) - Primary source: FBI statement accusing the DPRK (TraderTraitor group) of stealing over $6 billion from Binance around Oct 29, 2026, conversion to ETH, publication of address list; withdrawal of ~$3 billion from hot wallets, freezing of partial funds, and promise of reimbursement. - [ФБР обвинило хакеров из Северной Кореи в краже 1,5 миллиарда долларов на криптовалютной бирже](https://www.rfi.fr/ru/%D0%B2-%D0%BC%D0%B8%D1%80%D0%B5/20250227-%D1%84%D0%B1%D1%80-%D0%BE%D0%B1%D0%B2%D0%B8%D0%BD%D0%B8%D0%BB%D0%BE-%D1%85%D0%B0%D0%BA%D0%B5%D1%80%D0%BE%D0%B2-%D1%81%D0%B5%D0%B2%D0%B5%D1%80%D0%BD%D0%BE%D0%B9-%D0%BA%D0%BE%D1%80%D0%B5%D0%B8-%D0%B2-%D0%BA%D1%80%D0%B0%D0%B6%D0%B5-1-5-%D0%BC%D0%B8%D0%BB%D0%BB%D0%B8%D0%B0%D1%80%D0%B4%D0%B0-%D0%B4%D0%BE%D0%BB%D0%BB%D0%B0%D1%80%D0%BE%D0%B2-%D0%BD%D0%B0-%D0%BA%D1%80%D0%B8%D0%BF%D1%82%D0%BE%D0%B2%D0%B0%D0%BB%D1%8E%D1%82%D0%BD%D0%BE%D0%B9-%D0%B1%D0%B8%D1%80%D0%B6%D0%B5) - Separate earlier incident (February 2025) involving $1.5 billion; used purely as context for the persistent pattern of DPRK attacks, unrelated to the Oct 29, 2026 event. ## FAQ ### Who does the FBI accuse of the Binance theft? The FBI accuses the Democratic People's Republic of Korea and specifically the North Korean hacking group "TraderTraitor". ### What amount is mentioned in the FBI statement? The FBI points to the theft of over 6 billion US dollars in virtual assets from Binance around October 29, 2026; nearly 3 billion dollars was withdrawn from hot wallets on October 29 alone. ### What happened to the stolen funds? According to the FBI, the hackers primarily converted the assets into Ethereum, and some funds have already been frozen; Binance users were promised full reimbursement. The FBI also published a list of hacker addresses to block transactions.