The FBI has attributed a large theft from Binance to North Korea and identified the cyber group TraderTraitor as the alleged perpetrator.

Summary of the incident

Authorities report that attackers moved $6.36 billion across ten blockchains within about twenty minutes, TRM Labs estimates, mostly in a single wave.

The amount exceeds by roughly four times the value taken in the 2025 Bybit breach that the FBI previously linked to the same group.

How the compromise occurred

Binance says the intrusion originated after an engineer’s laptop was compromised, enabling unauthorized access that led to rapid fund transfers.

Investigators managed to freeze about $3 billion and published lists of suspect addresses, urging exchanges, DeFi services and node operators to block related transactions.

Responses from platforms and investigators

THORChain asserts it can halt its network operations but says it cannot reverse or block individual cross-chain swaps, limiting containment options.

Binance states it has reimbursed 90% of the stolen assets and that users will not incur losses as a result of the incident.

Remaining assets and ongoing work

TRM Labs reports hackers retained over 420,000 ETH and 18,270 BTC, equivalent to about $2.4 billion still under their control, according to the firm.

The FBI, the U.S. Secret Service and tax investigators continue to track fund flows and coordinate with industry partners to disrupt laundering and recover assets.