FBI accuses North Korea of stealing more than $6 billion in cryptocurrency from Binance

The Federal Bureau of Investigation (FBI) has accused North Korea of stealing more than US$6 billion (approximately Sh776 billion) in virtual assets from cryptocurrency exchange Binance in a cyberattack reportedly carried out on or about October 29, 2026.

In a cyber alert published on October 31, the FBI identified the operation as “TraderTraitor” and said it was working with the United States Secret Service (USSS) and the Internal Revenue Service Criminal Investigation division (IRS-CI) to track the stolen funds and disrupt efforts to launder them.

"The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH)," read the notice in part.

The reported theft is among the largest cryptocurrency heists ever disclosed. The FBI said its investigations found the attackers converted the stolen assets primarily into Ethereum, a digital currency that can be transferred between cryptocurrency wallets and traded across different platforms.

According to the FBI, the attackers are expected to move the stolen cryptocurrency through decentralised finance (DeFi) platforms and instant cryptocurrency swap services as they attempt to conceal the origin and movement of the funds.

DeFi platforms allow users to exchange, lend or transfer digital assets through blockchain-based systems, often without relying on a traditional financial intermediary. Instant swap services let users exchange one cryptocurrency for another, potentially creating additional transaction routes investigators must follow.

The FBI's warning indicates that investigators are monitoring the movement of the stolen assets and are seeking to prevent the funds from passing through services that could facilitate further laundering.

However, the agency's alert describes the expected laundering methods rather than confirming that all the stolen funds have already passed through those services.

The FBI, USSS and IRS-CI have urged private-sector organisations involved in cryptocurrency transactions to block transfers linked to digital wallet addresses associated with the TraderTraitor operation.

The agencies specifically named THORNode operators, remote procedure call (RPC) node operators, instant cryptocurrency exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers.

THORNode operators help maintain infrastructure supporting the THORChain blockchain network, while RPC nodes enable applications and services to communicate with blockchain networks. Blockchain analytics firms help trace transactions and identify connections between digital wallets.

The agencies are seeking cooperation from these organisations to identify and stop transactions involving the identified addresses, including funds derived from the original theft.

The FBI has published a list of cryptocurrency wallet addresses it says are holding or have held assets from the theft and are operated by, or closely connected to, North Korean TraderTraitor actors.

The incident has also raised questions about the financial impact on Binance customers and the exchange's ability to contain the damage.

According to a Reuters report published on October 31, Binance replaced about US$6 billion of the roughly US$6.3 billion in stolen assets using company funds to buy replacement tokens. The exchange said the remaining losses accounted for less than 10 per cent of the stolen assets and involved less-liquid cryptocurrencies that could take longer to source.

The report also said Binance and industry partners had identified approximately US$3 billion in affected assets and were working to freeze them.

The FBI said the investigation forms part of its broader efforts to identify and disrupt North Korea's cybercrime activities and cryptocurrency theft operations.

The agency has urged anyone with relevant information to contact their local FBI field office or submit information through its Internet Crime Complaint Centre.