Federal law enforcement authorities have mobilized across the cryptocurrency sector after tracing the theft of over $6 billion in digital assets from Binance to North Korea's state-sponsored TraderTraitor hacking unit. Stablecoin issuers have reportedly intervened to freeze more than $2.4 billion of the diverted funds.
According to an alert issued by the Federal Bureau of Investigation, the intrusion occurred on or about October 29, 2026. The bureau conducted its inquiry alongside the U.S. Secret Service and IRS Criminal Investigation, identifying the perpetrators as members of TraderTraitor, a campaign linked to the Lazarus Group.
Network Tracking and Laundering Blocks
Investigators tracked the attackers converting most of the stolen digital assets into Ethereum, with plans to route transactions through decentralized finance protocols and instant-swap services. To intercept the laundering pipeline, federal authorities instructed exchange operators, node operators, and blockchain analytics companies to blacklist transactions involving more than 600 Ethereum addresses, nearly 20 Bitcoin addresses, and one Solana address linked to the group.
According to reporting by blockchain tracing firm TRM Labs, the perpetrators spent about 36 hours preparing the breach, initially withdrawing small amounts from Tornado Cash. The attackers then emptied five Binance hot wallets of 233.46 million XRP within four minutes before targeting hot wallets on Optimism, Solana, Bitcoin, and Tron.
Exchange Recovery and Federal Inquiry
Binance reported that its preliminary inquiries indicate an employee's work laptop was compromised, granting attackers entry to internal authorization systems to clear unauthorized asset withdrawals. Exchange leadership later indicated the breach involved a more complex sequence than a single engineer laptop accessing a service container. In 2022, Binance experienced another major security breach where an attacker minted 2 million BNB tokens worth roughly $570 million, taking over $100 million.
President Donald Trump expressed skepticism regarding North Korea's direct role, telling reporters that investigators were still reviewing the incident. Federal records previously tied TraderTraitor to a $1.5 billion theft from Bybit in February 2025 and a $620 million hack in 2022.
