FBI and Secret Service Link North Korean Hackers to Binance Theft, Call for Action
The FBI and U.S. Secret Service have alleged that North Korean hackers were responsible for stealing over $6.3 billion from the cryptocurrency platform Binance last week.
In statements released over the weekend, both federal agencies attributed the theft to North Korea’s TraderTraitor hacking group and urged the cryptocurrency industry to take measures to prevent the laundering of the stolen funds.
The hackers have reportedly been moving and swapping the stolen cryptocurrency, executing thousands of automated transactions to obscure the source of the funds and convert them into coins that can be exchanged for fiat currency.
The FBI, Secret Service, and IRS specifically called upon cryptocurrency exchanges, decentralized finance companies, and other technical operators to block transactions linked to addresses used by TraderTraitor to launder the stolen assets.
The FBI provided a list of cryptocurrency addresses associated with TraderTraitor for this purpose.
According to the FBI, “TraderTraitor actors are converting stolen assets primarily into Ethereum (ETH).” The agency expects these assets to undergo further laundering through decentralized finance (DeFi) and instant swap services.
Following the attack, the Secret Service reported that it collaborated with cryptocurrency industry players and the Justice Department to identify and freeze a significant portion of the stolen cryptocurrency within minutes.
Blockchain security experts have indicated that approximately $3 billion has been frozen so far, although some platforms have argued that their decentralized nature prevents them from stopping transactions.
The attack on Binance, the world’s largest cryptocurrency exchange, garnered global attention and forced the platform to suspend operations for several days while it utilized reserve funds to replace the stolen coins.
Initially, Binance claimed that a compromised laptop belonging to an engineer was the source of the breach. However, further investigations revealed additional vulnerabilities.
CEO Richard Teng stated, “This was a complex attack. The attacker also used a self-destruct mechanism that destroyed tooling and traces as they went, making it more difficult for us to trace and investigate.”
Binance reopened its site for deposits and withdrawals on Sunday morning. Changpeng Zhao, the controversial founder and former CEO of Binance, acknowledged that U.S. law enforcement agencies played a crucial role in tracking and freezing the stolen funds, helping to stabilize the price of Bitcoin.
Automation in Laundering
Blockchain security firms Elliptic and Chainalysis warned that the North Korean group was employing automation to launder the stolen funds at speeds that complicate monitoring efforts. Experts tracked thousands of transactions that moved back and forth between the same wallets before passing through mixers and other platforms.
Elliptic co-founder Tom Robinson noted that the laundering process appeared to be “on autopilot,” likely involving automation with some human oversight.
Chainalysis senior investigator Pierce Vaughn stated that the laundering operation was clearly premeditated, allowing for the rapid use of DeFi platforms and other tools.
Experts indicated that North Korea has developed extensive experience in laundering funds stolen from cryptocurrency platforms, having conducted attacks for nearly a decade.
Michael Barnhart, a nation-state threat researcher at DTEX, explained that TraderTraitor’s strategy involves quickly offloading stolen funds to Chinese money launderers, thereby transferring the risk of tracking to these criminal syndicates.
Former FBI deputy director Cynthia Kaiser remarked that the complexity of North Korean money movements following crypto heists poses significant challenges for recovery efforts.
Chainalysis also reported that North Korea’s hacking campaigns against cryptocurrency firms accounted for nearly 90% of crypto hack losses in 2026, with the average reported loss per attack increasing from $50 million in 2021 to $185 million in 2026.
From 2021 to 2026, suspected North Korean hacks resulted in over $13 billion in losses.
TraderTraitor has been identified by the FBI and experts as a common perpetrator behind several high-profile cryptocurrency thefts, including a $1.4 billion theft from Dubai-based Bybit last year and nearly $300 million from KelpDAO in April 2026.
Last month, Bitget reported that North Korean hackers stole more than $387 million in a cyberattack. Investigators linked the Binance incident to previous thefts by noting that funds from Binance were mixed with cryptocurrency stolen from Bitget and other victims.
Source: The Record