The United States Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in cryptocurrency from Binance to North Korean hackers, warning that the stolen funds are already being converted into other digital assets as authorities attempt to prevent further laundering.
In a public service announcement issued on October 31, the FBI said the cyberattack, which occurred on or around October 29, 2026, was carried out by North Korean threat actors associated with an operation known as "TraderTraitor."
The announcement marks an official attribution by US federal authorities following earlier findings by blockchain intelligence firms linking the massive cryptocurrency theft to North Korean hackers.
According to the FBI, investigators working alongside the United States Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI) have observed the hackers converting stolen cryptocurrency primarily into Ethereum (ETH).
Authorities warned that the stolen assets could subsequently be moved through decentralized finance (DeFi) platforms and instant cryptocurrency swap services, potentially making the funds more difficult to trace as they pass through additional laundering stages.
DeFi platforms allow users to conduct financial transactions through blockchain-based services without relying on traditional financial intermediaries, while instant swap services enable cryptocurrencies to be exchanged quickly for other digital assets.
The FBI also called on cryptocurrency exchanges, blockchain operators, and other virtual asset service providers to help prevent the stolen funds from moving further through the financial system.
Among those urged to take action are THORNode operators, remote procedure call (RPC) node operators, instant exchanges, DeFi services, and blockchain analytics companies.
The agencies specifically asked these entities to block transactions involving cryptocurrency wallet addresses identified as being used by TraderTraitor actors, including transactions involving funds derived from those addresses.
To support the effort, the FBI published a list of Ethereum addresses associated with the theft, including wallets that currently hold or previously held stolen assets and are operated by or closely connected to the North Korean hackers.
The agency also encouraged individuals and organizations with information about the operation to contact their local FBI field office or submit reports through the FBI's Internet Crime Complaint Center.
The announcement follows an earlier assessment by blockchain intelligence firm TRM Labs, which attributed the estimated $6.36 billion Binance theft to North Korean hackers associated with TraderTraitor.
READ:
TRM Labs links North Korean hackers to record $6.36B Binance theft
The incident has been described by blockchain security researchers as the largest cryptocurrency theft on record.
