New Delhi [India], November 1 : The Federal Bureau of Investigation (FBI) has attributed the theft of more than USD 6 billion in virtual assets from cryptocurrency exchange Binance to North Korea, warning that the stolen funds are being converted into Ethereum and could be moved through decentralised finance (DeFi) platforms and instant-swap services to conceal their origins.
In a cyber alert issued on October 31, the FBI identified the operation as "TraderTraitor" and said the theft took place on or around October 29, 2026.
The agency, working with the US Secret Service (USSS) and the Internal Revenue Service's Criminal Investigation division (IRS-CI), said it had observed the attackers converting the stolen assets primarily into Ethereum (ETH).
The agencies have urged cryptocurrency exchanges, THORNode and RPC node operators, DeFi platforms, instant exchanges, blockchain analytics firms and other virtual asset service providers to block transactions involving wallet addresses linked to the stolen funds.
The FBI has also published a list of cryptocurrency addresses holding or previously holding assets connected to the theft, and asked organisations to prevent transactions originating from or linked to these addresses.
The security breach was first reported on October 30, a day after billions of dollars in cryptocurrency were transferred from Binance-controlled wallets on October 29. Approximately USD 6.36 billion in digital assets was moved across 10 blockchain networks. Binance initially said it was investigating a potential security issue and temporarily suspended withdrawals across several networks as a precaution.
The TraderTraitor label has previously been used by US authorities to identify North Korean-linked cyber operations targeting cryptocurrency platforms. The FBI has associated the activity with groups also known as Lazarus Group and APT38.
In February 2025, the FBI attributed the theft of approximately USD 1.5 billion in virtual assets from cryptocurrency exchange Bybit to the same North Korean-linked activity. At the time, the agency said the attackers were moving the stolen assets across thousands of addresses and multiple blockchains to facilitate further laundering
The FBI has also linked TraderTraitor-affiliated actors to earlier cryptocurrency thefts, including attacks involving Alphapo, CoinsPaid and Atomic Wallet in 2023. It has warned that North Korea uses cybercrime and virtual asset theft to generate revenue for the regime. 
The FBI has asked anyone with relevant information to contact a local FBI field office or report it through its Internet Crime Complaint Center.