NAIROBI, Kenya – The Federal Bureau of Investigation (FBI) has accused North Korea of stealing more than US$6 billion (approximately Sh776 billion) in cryptocurrency from Binance, in one of the largest digital asset thefts ever reported.
In a cyber alert published on October 31, 2026, the FBI identified the operation as TraderTraitor and said the attack took place on or about October 29.
The agency said it was working with the United States Secret Service (USSS) and the Internal Revenue Service Criminal Investigation division (IRS-CI) to trace the stolen funds, disrupt laundering efforts and prevent further movement of the cryptocurrency.
“The FBI is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance,” the agency stated.
The FBI said investigators had observed the attackers converting the stolen assets primarily into Ethereum (ETH), one of the world’s most widely traded cryptocurrencies.
The agency warned that the hackers were expected to move the funds through decentralised finance (DeFi) platforms and instant cryptocurrency swap services as part of efforts to conceal their origins.
FBI publishes cryptocurrency wallet addresses
The FBI has called on cryptocurrency businesses and blockchain service providers to help block transactions connected to the operation.
Among the organisations specifically urged to cooperate are THORNode operators, remote procedure call (RPC) node operators, instant cryptocurrency exchanges, DeFi platforms, blockchain analytics firms and other virtual asset service providers.
The agency also published a list of cryptocurrency wallet addresses it said were holding or had previously held assets linked to the theft.
According to the FBI, the addresses are operated by or closely connected to North Korean TraderTraitor actors.
The list includes Ethereum, Bitcoin and Solana wallet addresses, giving cryptocurrency platforms and investigators specific identifiers to monitor when tracing suspicious transactions.
The FBI said cooperation from the private sector would help prevent the stolen assets, as well as funds derived from them, from being transferred through services that could facilitate laundering.
However, the agency described the use of DeFi platforms and instant swaps as an expected next stage of the laundering process, rather than confirming that all the stolen funds had already passed through those services.
Binance replaces about Sh776 billion in stolen assets
Despite the scale of the attack, Binance has moved to reassure customers that the incident will not leave them bearing the financial losses.
In a report published on October 31, Reuters said the cryptocurrency exchange had replaced approximately US$6 billion of the roughly US$6.3 billion stolen using company funds to purchase replacement tokens.
The exchange said the remaining losses accounted for less than 10 per cent of the stolen assets and involved less-liquid cryptocurrencies that could take longer to source.
Binance co-CEO Richard Teng said the company had replenished 90 per cent of the stolen assets and was committed to covering the outstanding amount.
The exchange and its industry partners had also identified approximately US$3 billion in affected assets and were working to freeze them.
The reported response involved resources from Binance’s corporate treasury, its Futures Insurance Fund and its Secure Asset Fund for Users (SAFU).
How the North Korean hackers are moving the money
The FBI’s findings point to Ethereum as the primary cryptocurrency into which the attackers have been converting the stolen assets.
Ethereum transactions are recorded on a public blockchain, allowing investigators and analytics firms to trace movements between wallet addresses.
However, moving funds through multiple wallets, decentralised exchanges and instant swap services can make investigations more complex, particularly where assets are converted into different cryptocurrencies across several networks.
DeFi platforms allow users to exchange, lend and transfer digital assets through blockchain-based systems, often without relying on conventional financial intermediaries.
Instant swap services also allow users to exchange one cryptocurrency for another without necessarily using a traditional exchange account.
The FBI’s warning is aimed at disrupting these channels by encouraging operators to identify and block transactions connected to the listed wallet addresses.
North Korea’s cryptocurrency theft operations
The FBI’s attribution of the Binance incident to North Korea adds to longstanding concerns over the country’s use of cyber operations to generate revenue through cryptocurrency theft.
The United States has repeatedly accused North Korean-linked hacking groups of targeting cryptocurrency exchanges, financial institutions and blockchain companies to obtain digital assets.
The TraderTraitor designation has previously been associated with North Korean cyber operations targeting the cryptocurrency industry.
The latest investigation brings together the FBI, US Secret Service and IRS Criminal Investigation division in an effort to track the stolen assets and prevent their conversion into funds that could be moved beyond the reach of investigators.
The FBI has urged anyone with information about the operation to contact their local FBI field office or submit a report through its Internet Crime Complaint Centre.
