---
title: FBI Attributes $6.3 Billion Binance Heist to North Korea as Pyongyang Denies Involvement
description: The FBI has attributed the October 29 theft of approximately $6.36 billion from Binance to North Korea's TraderTraitor operation, following coordinated unauthorized cryptocurrency transfers across ten blockchains.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [FBI Attributes $6.3 Billion Binance Heist to North Korea as Pyongyang Denies Involvement](https://blog.polyswarm.io/fbi-attributes-6.3-billion-binance-heist-to-north-korea-as-pyongyang-denies-involvement)

 Written by [The Hivemind](https://blog.polyswarm.io/author/the-hivemind) | Nov 6, 2026, 6:37:33 PM

**Verticals Targeted:** Cryptocurrency

## **Executive Summary**

## The FBI has attributed the October 29 theft of approximately $6.36 billion USD from Binance to North Korea's TraderTraitor operation, following coordinated unauthorized cryptocurrency transfers across ten blockchains. Blockchain investigators identified evidence suggesting compromised transaction authorization capabilities, while North Korea rejected the US attribution as politically motivated. The incident highlights the risks associated with trusted signing infrastructure, privileged access, and transaction approval workflows.

**Key Takeaways**

- Attackers stole approximately $6.36 billion USD in cryptocurrency from Binance on October 29, 2026, executing coordinated unauthorized transfers across ten blockchains in roughly 20 minutes.
- The FBI attributed the theft to North Korea's TraderTraitor activity on October 31, while TRM Labs identified evidence suggesting the attackers compromised transaction authorization capabilities, including abuse of Ethereum's EIP-7702 functionality.
- North Korea denied responsibility on November 3, with Kim Yo Jong dismissing the FBI's attribution as politically motivated. The denial did not include technical evidence identifying an alternative perpetrator.
- Approximately $2.7 billion USD in stolen assets was initially frozen or secured, while the remaining funds presented ongoing laundering and recovery challenges. The incident highlights risks involving privileged access, signing infrastructure, and trusted transaction approval workflows.

**Background**

On October 29, 2026, attackers stole approximately $6.36 billion USD in cryptocurrency from [Binance](https://www.binance.com/en), executing unauthorized transfers across ten blockchains in what TRM Labs [described](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history) as the largest cryptocurrency theft on record. Most of the assets were transferred within approximately 20 minutes, beginning at 20:05 UTC.

On October 31, the Federal Bureau of Investigation formally [attributed](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack) the theft to North Korea, identifying the activity as being associated with TraderTraitor. The bureau reported that the attackers were converting stolen assets primarily into Ether (ETH), with additional laundering expected through decentralized finance (DeFi) platforms and instant-swap services.

North Korea rejected the attribution in a statement carried by the Korean Central News Agency (KCNA) and reported by international news organizations on November 3. Kim Yo Jong, sister of North Korean leader Kim Jong Un, characterized the FBI's allegations as a political provocation and accused Washington of attempting to portray the country as responsible for international cybercrime. The statement did not provide forensic evidence identifying an alternative perpetrator.

**The Heist**

TRM Labs identified coordinated transfers from Binance-controlled wallets across ten blockchain networks, suggesting that the attackers obtained access to infrastructure capable of authorizing transactions rather than exploiting a vulnerability shared by the affected blockchains. Ethereum accounted for approximately $3.79 billion of the stolen assets, followed by Bitcoin at $1.47 billion and Tron at $628 million. Additional losses affected XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon.

The Ethereum component involved abuse of EIP-7702, a protocol feature that allows externally owned accounts to delegate execution to smart contract code. Investigators identified 50 pre-signed authorizations covering consecutive nonce values. One valid authorization enabled the attacker to delegate an Ethereum hot wallet to a malicious sweeper contract, allowing repeated unauthorized transfers as additional assets entered the wallet.

On the other affected networks, the attackers used ordinarily signed transactions to transfer funds into attacker-controlled addresses. The coordinated execution across different signing systems led TRM Labs to assess that the attackers likely gained the ability to make Binance's hot-wallet signing infrastructure authorize transactions of their choosing.

The precise initial access method remains unconfirmed. Publicly available findings do not establish whether the attackers obtained access through compromised credentials, an employee workstation, internal transaction approval systems, or another entry point. Binance also reported that it had found no evidence of leaked wallet private keys during its initial investigation.

**What is TraderTraitor?**

TraderTraitor is a designation used by US authorities for North Korean state-sponsored cyber activity targeting cryptocurrency exchanges, blockchain companies, and other digital asset organizations. The activity overlaps with operations associated with Lazarus Group and APT38, although these designations do not necessarily refer to identical operational units.

TraderTraitor campaigns have historically relied on social engineering, spearphishing, and malicious cryptocurrency applications to compromise employees and gain access to sensitive financial infrastructure. In April 2022, CISA, the FBI, and the US Treasury Department [warned](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a) that North Korean operators were distributing trojanized cryptocurrency applications, including malicious versions of legitimate-looking trading software. These applications could provide attackers with access to compromised systems and facilitate subsequent theft.

The FBI [attributed](https://www.fbi.gov/investigate/cyber/alerts/2025/north-korea-responsible-for-1-5-billion-bybit-hack) the February 2025 theft of approximately $1.5 billion USD from cryptocurrency exchange Bybit to TraderTraitor. That operation involved manipulation of a trusted transaction approval workflow, demonstrating how attackers could redirect cryptocurrency assets without directly exploiting blockchain protocols.

The 2026 Binance incident represents another major theft attributed to TraderTraitor, although investigators have not publicly established its initial access vector. The group's documented history illustrates the risks posed by social engineering, malicious software, and compromised transaction authorization systems within cryptocurrency infrastructure.

**Attribution and Denial**

The FBI's October 31 announcement identified North Korea as responsible for the Binance theft and published cryptocurrency addresses associated with TraderTraitor's laundering activity. The bureau, working with the US Secret Service and IRS Criminal Investigation, urged exchanges, blockchain infrastructure providers, and other virtual asset services to block transactions involving the identified addresses.

TRM Labs also attributed the attack to TraderTraitor, citing on-chain and off-chain intelligence. Its investigation identified operational similarities to previous North Korean cryptocurrency thefts, including advance preparation, Tornado Cash funding activity, pre-positioned authorizations, and rapid execution of unauthorized transfers.

North Korea [disputed](https://www.koreaherald.com/article/10924126) the accusation. In a statement carried by KCNA, Kim Yo Jong characterized the FBI's attribution as politically motivated and accused Washington of attempting to damage the country's international reputation. She also questioned US intentions regarding the eventual recovery of stolen cryptocurrency, suggesting that the ultimate recipient of recovered assets could offer clues about responsibility for the attack.

Although the FBI has not publicly disclosed the complete intelligence supporting its attribution, both the bureau and TRM Labs identify TraderTraitor as responsible. TRM's published analysis provides additional technical evidence of the attack's execution, while North Korea's denial does not offer an alternative forensic explanation.

**Financial Impact**

The approximately $6.36 billion USD theft exceeded the $1.5 billion stolen from Bybit in February 2025 and affected assets held across ten blockchain networks. According to TRM Labs' initial investigation, approximately $2.7 billion in stolen assets had been frozen or moved beyond the attacker's control during the early response. This included approximately $2.67 billion in stablecoins frozen by issuers and additional assets secured through emergency action by Arbitrum's Security Council.

These restrictions prevented further movement of affected assets but did not necessarily constitute their recovery by Binance. Meanwhile, the attackers attempted to convert or move other stolen assets before restrictions could be imposed, complicating recovery efforts. Binance confirmed the security incident and temporarily suspended withdrawals on several affected networks as investigators worked to contain the attack and trace the stolen assets.

**PolySwarm Analyst Commentary**

The Binance theft demonstrates how attackers who gain access to trusted transaction authorization capabilities can execute high-value transfers without exploiting vulnerabilities in the underlying blockchain networks. The coordinated activity across ten blockchains suggests that the attackers obtained the ability to generate valid transaction signatures through Binance's infrastructure, raising concerns about privileged access management, transaction approval workflows, and the concentration of trust within financial systems.

The FBI's attribution to TraderTraitor places the incident within North Korea's established history of targeting cryptocurrency organizations for financial gain. Although the initial access vector remains unconfirmed, previously documented TraderTraitor operations have involved social engineering, malicious applications, and compromised employee environments. These techniques remain relevant to organizations operating sensitive financial infrastructure, particularly where access to internal systems or software dependencies could expose critical authorization processes.

Organizations should therefore extend malware detection beyond traditional endpoint security while strengthening protections around privileged infrastructure. PolySwarm's multi-engine threat intelligence platform helps security teams investigate suspicious files, identify malicious applications, and detect emerging threats that individual security products may overlook. While malware has not been confirmed as the entry point in the Binance incident, these capabilities can strengthen defenses against the broader intrusion techniques associated with North Korean cyber operations.

**IOCs**

At the time of writing, no malware samples have been identified in public reporting in relation to this incident. However, PolySwarm has multiple samples of malware known to be associated with TraderTraitor.

 

e3d98cc4539068ce335f1240deb1d72a0b57b9ca5803254616ea4999b66703ad - AlticGO\_R.exe, TraderTraitor Dropper

8acd7c2708eb1119ba64699fd702ebd96c0d59a66cba5059f4e089f4b0914925 - AlticGO.exe, TraderTraitor Dropper

9ba02f8a985ec1a99ab7b78fa678f26c0273d91ae7cbe45b814e6775ec477598 - Esilet.dmg, TraderTraitor Dropper (macOS variant)

9d9dda39af17a37d92b429b68f4a8fc0a76e93ff1bd03f06258c51b73eb40efa - Esilet tmpzpsb3, Manuscrypt RAT (macOS variant)

dced1acbbe11db2b9e7ae44a617f3c12d6613a8188f6a1ece0451e4cd4205156 - Esilet-tmpg7lpp, Manuscrypt RAT (macOS variant)

867c8b49d29ae1f6e4a7cd31b6fe7e278753a1ba03d4be338ed11fd1efc7dd36 - win32.bin, Manuscrypt RAT

89b5e248c222ebf2cb3b525d3650259e01cf7d8fff5e4aa15ccd7512b1e63957 - darwin64.bin, Manuscrypt RAT (macOS variant)

 

***Don’t have a PolySwarm account? Go*** [**here**](https://polyswarm.network/?__hstc=222807940.d76e0d027694f1f067a520c263d793ab.1752859606844.1793384101892.1793640782012.276&__hssc=222807940.1.1793640782012&__hsfp=6e260c68014e53dc14386db5b73c165a) ***to sign up for a free Community plan or subscribe.***

***Contact us at*** [**hivemind@polyswarm.io**](mailto:hivemind@polyswarm.io) ***| Check out our*** [**blog**](https://blog.polyswarm.io/) *|* [**Subscribe**](https://polyswarm.io/ransomwarereport/) ***to our reports.***

 

[View full post](https://blog.polyswarm.io/fbi-attributes-6.3-billion-binance-heist-to-north-korea-as-pyongyang-denies-involvement)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "The Hivemind"
  },
  "dateModified" : "2026-11-06T18:37:33.463Z",
  "datePublished" : "2026-11-06T18:37:33Z",
  "headline" : "FBI Attributes $6.3 Billion Binance Heist to North Korea as Pyongyang Denies Involvement",
  "image" : {
    "@type" : "ImageObject",
    "height" : 900,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/Threat%20Bulletins/Threat%20Bulletin%20Images/FBA%20ATTRIBUTES%202026.jpg",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/fbi-attributes-6.3-billion-binance-heist-to-north-korea-as-pyongyang-denies-involvement",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```