North Korea's TraderTraitor blamed for $6.3bn Binance hack: what next

The FBI formally attributed the theft of approximately $6.3 billion in digital assets from Binance to North Korea's state-sponsored TraderTraitor unit on October 31, 2026. The hack occurred on or about October 29, when attackers gained access to Binance hot wallets. Binance co-CEO Richard Teng described it as a "complex attack." It is the largest crypto heist on record.

The agency expects further laundering through DeFi and instant swap services. The FBI asked crypto exchanges and blockchain analytics firms to block transactions linked to identified addresses.

TRM Labs independently attributed the attack to TraderTraitor with high confidence. The firm reported that the attacker moved funds across ten blockchains in about 20 minutes, using an EIP-7702 delegation on Ethereum and 50 pre-signed authorizations. That pattern points to a compromise of Binance's hot wallet signing infrastructure.

Binance suspended withdrawals after the hack. The exchange said it replaced 90% of stolen assets using company funds; the remaining 10% consists of less liquid tokens. Withdrawals resumed in phases starting Sunday.

President Donald Trump, asked about North Korean involvement, said officials were looking into the hack. Some outlets framed his answer as doubt about the FBI's finding.

The FBI's formal attribution turns a private-sector suspicion into a state-level accusation. It tests whether sanctions enforcement can keep pace with North Korea's evolving crypto laundering tactics. It also raises urgent questions about hot wallet security at even the largest exchanges.

TRM Labs observed funds moving across ten blockchains in 20 minutes.