WORLDTECHFBI attributes $6 billion Binance theft to North Korean group TraderTraitor
The FBI has tied the theft of more than $6 billion in virtual assets from the cryptocurrency exchange Binance to North Korean hackers, according to GBHackers. The advisory, issued on October 31, names the operation TraderTraitor but leaves open how the attackers got in.
Timing and official attribution
According to the FBI advisory, the exchange was targeted around October 29, 2026. The statement is an official attribution of the theft to North Korean actors, and it is the central development in the case as GBHackers reports it.
Because the advisory names a specific group, it moves the incident beyond the earlier accounts of the breach, which did not carry an official attribution.
Where the stolen funds went
Investigators from the FBI, the Secret Service and the IRS Criminal Investigation unit have seen the attackers convert most of the stolen assets into Ethereum. That conversion has been observed, while the details of any later laundering remain unconfirmed.
Authorities expect the proceeds could move on through decentralised finance platforms and instant swap services, but that expectation has not been confirmed.
What the advisory leaves unestablished
The advisory names no exploited vulnerability, malware family, compromised signing mechanism or initial access technique. Pointing to phishing, stolen private keys or a supply chain intrusion would therefore go further than the FBI statement does.
GBHackers notes that earlier reporting on TraderTraitor describes social engineering, credential theft and compromised development environments. That record shows what the group is capable of but does not show that those methods were used against Binance.
The material also refers to a list of addresses linked to TraderTraitor, yet no wallet addresses are included in the supplied information.
Open questions
- How did the attackers gain access to Binance's systems?
- Which specific vulnerability or technique, if any, was used in the breach?