What Is TraderTraitor, the Group Behind the $6B Binance Hack?

The FBI has attributed the theft of more than $6 billion in cryptocurrency from Binance to a North Korean hacking unit it calls TraderTraitor, and dated the attack to on or about 29 October 2026. In its alert, the bureau said it had observed the group converting the stolen assets "primarily into Ether (ETH)" and expects them to be laundered further through DeFi and "instant swap services."

Key Facts

• The FBI says North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance, on or about 29 October 2026, and names the activity "TraderTraitor".
• Binance said it set aside about $6.34 billion of company funds and had replenished 90% of the amount stolen, with the last 10% in less liquid tokens.
• By Sunday afternoon on 1 November, $4.6 billion of withdrawals against $1 billion of deposits left a net outflow of about $3.6 billion, or 2.1% of Binance's $171 billion in total assets under management.
• The FBI asked THORNode operators, RPC node operators, instant exchanges, DeFi services and analytics firms to block transactions tied to TraderTraitor addresses.
• The same unit is linked to the $1.5 billion Bybit hack and a $308 million bitcoin heist from the DMM exchange.

If you hold assets on Binance, the question that matters is who eats the loss. Binance said it would "fully cover the financial impact of the funds stolen", and the money to do it came from part of its $1 billion secure asset fund for users, a bitcoin reserve it keeps for breaches, some of its futures insurance fund and its own corporate treasury. The exchange said it had replenished 90% of the amount taken, with the remaining 10% in tokens that are less liquid and may take longer to buy.

The market moved first. Bitcoin fell nearly 5% after the news, ether nearly 6%, and BNB, Binance's own token, nearly 10%.

Then the money left. By Sunday afternoon on 1 November, Binance had processed $4.6 billion of withdrawals against $1 billion of deposits, a net outflow of about $3.6 billion, or 2.1% of its $171 billion in total assets under management, as the exchange worked through the largest crypto heist on record.

The FBI Alert Asks the Industry to Block the Wallets

The alert goes past naming a culprit. The FBI, working with the Secret Service and IRS Criminal Investigation, said the stolen assets are being swapped mainly into ether, and that it expects them to be pushed through DeFi and instant swap services "as they prepare them for further laundering stages".

It then asked the industry to act. THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers were urged to block transactions "with or derived from" the addresses TraderTraitor is using. The request is pointed at the venues the coins must pass through before they can be spent.

Who TraderTraitor Is

TraderTraitor is the name US agencies give a cluster of North Korean state activity aimed at stealing digital assets. It is not a person, and it is not new. In an April 2022 joint advisory, the FBI, CISA and the US Treasury tied the DPRK-backed entities behind it to labels security researchers already used: Lazarus Group, APT38, BlueNoroff and Stardust Chollima.

The same activity has been tracked under other names, including UNC4899, Jade Sleet and Slow Pisces. North Korea's Reconnaissance General Bureau is believed to be the agency behind Lazarus and its subgroups, with some analysis pointing to its 3rd bureau, the Bureau of Foreign Intelligence.

TraderTraitor is believed to be part of the Lazarus Group, which was accused in 2014 of hacking Sony Pictures. In 2023 the unit expanded into open-source software supply chain attacks, one of the first known cases of a nation-state group using public package repositories to reach targets.

Bybit, DMM and Ronin: The Same Unit, Smaller Numbers

Binance is the biggest target, not the first. The FBI and Japan's National Police Agency attributed a $308 million bitcoin heist from the DMM exchange in May 2024 to TraderTraitor. The FBI also blamed the group for a $1.5 billion hack of the Bybit exchange, which held the record for the largest crypto theft before this one.

The broader Lazarus record includes the $620 million Ronin Network breach, where the group compromised a blockchain game company employee with a fake job offer PDF and application.

North Korea Denies It, and the Total Is Disputed

North Korea rejected the attribution, calling the FBI announcement "a trite provocation". Kim Yo Jong, the sister of leader Kim Jong Un, said Pyongyang saw it as "an extension of Washington's invariable hostile policy toward" North Korea and ruled out dialogue until that policy changed. That is the state's own position and has not been independently verified.

President Donald Trump was not ready to settle it either, saying of the case: "We don't know if it's North Korea."

The size is not one number. The FBI says "more than $6 billion"; Binance and most coverage put it at $6.3 billion; the $6.34 billion figure is what Binance set aside to cover the loss. The range, rather than a single precise total, is what is confirmed.

Ari Redbord, chief policy officer at TRM Labs, said he expects the hackers to break the stolen assets into pieces and try to launder them through smaller exchanges to evade detection, over months. Whether that slows the laundering depends on how many exchanges, bridges and node operators act on the FBI's request.