The FBI has attributed the $6.3 billion cryptocurrency theft from Binance to North Korea's TraderTraitor hacking operation, identifying the same group linked to the $1.5 billion Bybit attack in 2025.
In an October 31 cyber alert, the agency confirmed that the attackers were converting stolen assets primarily into Ethereum, potentially preparing them for laundering through decentralized finance platforms and instant-swap services.
The attack itself occurred October 29.
Binance's preliminary investigation suggests the breach may have begun with a compromised DevOps engineer's laptop, allowing unauthorized access to a service container used to submit withdrawal transactions.
However, investigators subsequently identified additional points of compromise. Binance reports no evidence that wallet private keys were leaked, and the complete attack sequence remains unconfirmed.
The incident recalls North Korea's earlier record-breaking attack on Bybit, within a wider pattern of state-linked cryptocurrency theft. The surge in cryptocurrency theft has become one of the most pressing security concerns of the digital age. Crypto theft rose from $2.2 billion in 2024 to over $3.4 billion in 2025—a 55% year-over-year increase—and has already exceeded $7 billion in 2026,
The FBI has urged exchanges, blockchain operators and analytics companies to block transactions involving identified attacker-controlled addresses.