UPDATE: FBI and US agencies tie Binance breach to North Korea's TraderTraitor
CIE News ·
Update to UPDATE: Investigators link North Korea to $6.3B Binance security exploit
Preliminary statement from the organization involved; full details not yet released.
US federal agencies officially attributed the $6.3 billion Binance breach to North Korea's TraderTraitor unit, urging private entities to blackhole associated wallet addresses.
The FBI, U.S. Secret Service, and IRS Criminal Investigation have officially attributed the multi-billion-dollar Binance breach to North Korea's state-sponsored TraderTraitor cyber unit, which is tied to the Lazarus Group. As previously reported, crypto intelligence firms had tied the Democratic People's Republic of Korea to the $6.3 billion exploit. The joint federal advisory confirmed the state-sponsored group's role and outlined active efforts to track the stolen capital.
According to federal investigators, the perpetrators are converting stolen multi-chain assets into Ethereum (ETH) while utilizing decentralized finance protocols and instant exchangers to launder the proceeds. In response, the agencies directed private sector entities, including THORChain nodes and DeFi platforms, to blackhole addresses linked to the attackers.
The breach, which occurred on October 29, 2026, extracted roughly $6.36 billion across 10 blockchains, according to Wikipedia. Binance paused trades and withdrawals following the attack, with partners such as Tether and Circle freezing around $3 billion in stolen stablecoins. Binance stated it plans to restore customer withdrawals on November 1, 2026, and publish proof of reserves on November 2, 2026.
Key facts
- Attributed to TraderTraitor
- FBI, USSS, IRS-CI advisory
- Laundering into ETH via DeFi
- Private sector told to blackhole