The U.S. Federal Bureau of Investigation (FBI) has officially designated North Korea as the mastermind behind the Binance hack, which resulted in the theft of over $6 billion in virtual assets from the world’s largest cryptocurrency exchange. Authorities have also confirmed signs that the stolen assets are being converted into Ethereum.
In a press release issued on the 31st of last month (local time), the FBI stated that the theft of more than $6 billion in virtual assets from the cryptocurrency exchange Binance on October 29, 2026, was the work of North Korea. This marks the first time the FBI has officially confirmed North Korea’s involvement in the incident, identifying the North Korean hacking group ‘TraderTraitor’ as the perpetrator.
Working alongside the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI), the FBI stated it has confirmed that TraderTraitor hackers are converting the stolen assets primarily into Ethereum (ETH). Furthermore, authorities anticipate that the hackers will continue their money laundering activities by subsequently transferring the assets through decentralized finance (DeFi) platforms and instant exchange services.
Consequently, the FBI and partner agencies released a massive list of cryptocurrency addresses that currently hold or previously held the stolen assets. They explained that these addresses are operated by or closely linked to TraderTraitor hackers. They further urged cryptocurrency exchanges, DeFi services, and blockchain analytics firms to block direct transactions with these addresses as well as any trading of assets originating from them.
However, the FBI did not disclose specific evidence or the initial infiltration vector used to attribute the breach to North Korea. The FBI stated that it will protect the cryptocurrency community by identifying, mitigating, and disrupting North Korea’s illicit cybercrimes and virtual asset theft activities.
