In brief
The FBI has identified a North Korean group, TraderTraitor, as the mastermind behind Binance’s $6.3 bn theft, alleging the culprits launder the stolen crypto mainly into Ethereum. Binance has used its Secure Asset Fund for Users and other reserves to cover 90 % of the loss, and will buy the remaining tokens to reach full coverage. The agency urged virtual asset service providers to block transactions linked to the laundering operation.
The FBI announced on Saturday that a North Korean hacking collective, TraderTraitor, is responsible for the largest recorded crypto theft, wiping out $6.3 bn from Binance. The agency said the attackers converted most of the stolen assets into Ethereum before attempting to launder them in stages.
Binance said it had replaced 90 percent of the stolen value by using company reserves, including a $1bn Secure Asset Fund for Users, portions of its Futures Insurance Fund and corporate treasury. The exchange stated, “We will continue to buy the remaining relevant token assets… until the covered amount reaches 100 percent for all tokens. Binance will absorb the financial impact of these stolen funds, not our users.”
The FBI provided suspected digital addresses for VASPs to monitor and block transactions linked to the laundering operation. In a separate note, the agency referenced TraderTraitor’s role in a $1.5 bn theft from Bybit earlier in 2026.
Following the announcement, crypto prices fell on Friday as the market reacted to the sizeable security breach and Binance’s efforts to reassure customers.
