Malware · Threat Intelligence
FBI links North Korea to $6.3bn Binance crypto theft and publishes 628 wallet addresses
The FBI has named North Korean hackers as responsible for the $6.3bn Binance theft and published 628 crypto wallet addresses linked to the stolen funds, urging services to block them.
Ross Grant2 min read
The short version
Hackers stole about $6.3 billion from Binance, a major cryptocurrency exchange. The FBI says North Korea’s TraderTraitor group is behind the theft and has published 628 wallet addresses linked to the stolen money. Binance says it has frozen about $3 billion with help from law enforcement. The FBI is asking crypto services to block transactions involving these addresses to stop the thieves from moving the money.
By the numbers
- $6.3bntotal stolen from BinanceHackread
- 628crypto wallet addresses linked to the theftHackread
- $3bnassets frozen with law enforcement helpHackread
What happened?
The FBI has linked the theft of about $6.3 billion from Binance to North Korea’s TraderTraitor group and published 628 cryptocurrency wallet addresses associated with the stolen funds. The theft occurred around 29 October 2026. Binance said a compromised DevOps engineer’s laptop allowed attackers to submit unauthorised withdrawals. About $3 billion has been frozen, but it is not yet considered recovered. Only Hackread has reported this so far, and there is no primary source for the FBI’s announcement.
Who is affected
Binance, one of the world's largest cryptocurrency exchanges, reported that attackers stole about $6.3 billion on or around 29 October 2026. The FBI has linked the theft to North Korea’s TraderTraitor group and published 628 cryptocurrency wallet addresses connected to the stolen funds. The affected wallets include 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address. Binance said it had worked with law enforcement and industry partners to freeze about $3 billion of the assets, but these are not yet considered recovered funds. The FBI has asked cryptocurrency businesses, including exchanges, decentralised finance (DeFi) services and blockchain analytics firms, to block transactions involving these addresses. Hackread (opens in a new tab)
How the attack worked
According to Binance, the attackers gained access through a compromised DevOps engineer’s laptop. This allowed them to access a service container and submit unauthorised withdrawal transactions. Binance stated there was no evidence that wallet private keys were leaked. The exchange later found additional breach points, but has not publicly explained them. Investigators from the FBI, US Secret Service and IRS Criminal Investigation observed the attackers converting stolen assets mainly into Ethereum. They expect the attackers to attempt further laundering through DeFi platforms and instant cryptocurrency swap services.
The response
The FBI’s announcement, as reported by Hackread, asked cryptocurrency infrastructure operators to block transfers involving the listed addresses. This includes THORNode operators, RPC node operators, instant exchanges and other virtual asset service providers. Binance has promised to cover all losses for affected users and plans to release a technical report after its investigation is complete. The FBI is also asking anyone with information about the theft to contact its field offices or submit a report online. No new figure for assets recovered has been provided since the initial freeze.
What you should do
If you operate a cryptocurrency service or handle virtual assets, check transactions against the FBI’s published list of addresses. Blocking transfers to or from these addresses can help prevent further movement of stolen funds. Users should be cautious about interacting with unknown wallets and monitor Binance’s updates for further guidance.
Only Hackread has reported the FBI’s announcement so far, and there is no primary source or official statement available for independent verification. The FBI’s announcement does not explain how the engineer’s laptop was compromised or detail all breach points. The total amount ultimately recoverable remains unknown.
Why it matters
This is one of the largest cryptocurrency thefts ever reported. The FBI’s move to publish wallet addresses is meant to help the industry stop the stolen funds from being laundered. It also shows how attackers can target staff devices to breach even the biggest exchanges.
Key points
- FBI links $6.3bn Binance theft to North Korea’s TraderTraitor group
- 628 crypto wallet addresses published for blocking
- Attackers accessed Binance via a compromised engineer’s laptop
- About $3bn in assets have been frozen, but not yet recovered
- Crypto services are urged to block transactions involving the listed addresses
Sources
Hackread
Reference
