FBI Pins $6.36B Binance Hack on North Korea TraderTraitor Group
Reports say the FBI has attributed the $6.36 billion Binance hack to North Korea's TraderTraitor group and sought blocks on the laundering trail. Binance says it has replenished 90% of losses and still targets Nov. 1 for withdrawals.
What began as a judgment by blockchain analysts has become a law enforcement finding. The FBI has attributed the Binance hack to North Korea's TraderTraitor group, according to reports, and the bureau has sought blocks on the trail the laundered funds are taking.
That is the new piece of the story. In our earlier coverage, the North Korea link rested on analysis from private firms TRM, Chainalysis and Elliptic. Earlier reporting had said no U.S. government agency had publicly assigned responsibility. Later reports describe the FBI naming TraderTraitor. The text of the FBI statement itself was not in the material we reviewed, so the attribution rests on those reports.
The scale of the theft explains why the finding carries weight. Roughly $6.36 billion left Binance wallets across 10 blockchains in a rapid operation, reportedly the largest crypto theft on record, after attackers reportedly used access from a Binance engineer's infected computer to reach systems authorized to approve withdrawals. The FBI had previously attributed the $1.5 billion Bybit theft in 2025 to the same group, according to the reports.
Recovery and Binance's response
As we reported, Binance froze roughly $3 billion of the affected assets. Estimates of what token issuers and blockchain administrators immobilized through emergency interventions run from $2.7 billion to $3 billion.
Binance's latest update goes further. The exchange says it has replenished 90% of the losses and will keep buying the remaining tokens over the counter (OTC, meaning direct trades with large sellers rather than on public order books) until all losses are covered. It has pledged to absorb the damage, maintains that customer assets are protected, and has kept Nov. 1 as its target to restart withdrawals.
What it means
TraderTraitor sits under the Lazarus umbrella alongside Bluenoroff. It helps to read Lazarus as a label, not a single gang: one name covering several state-linked teams. The Binance case adds to a long record. One tally counts 296 suspected North Korea-linked thefts totalling about $13.3 billion, with differing levels of evidence, and federal authorities attributed the Ronin, DMM Bitcoin and Bybit incidents to North Korean actors.
Those tallies come with an important caveat. They do not show how much money actually reached the North Korean government, because they include recovered or frozen assets and disputed attributions.
The attribution also gives the bureau a direct role in the recovery. Its push to block the laundering trail now sits alongside the freezes issuers and administrators have already applied. The reports describe the finding as raising security concerns that could weigh on Bitcoin, while Binance insists customer assets are protected. None of the reports say whether the FBI's blocks will recover meaningful funds beyond the roughly $3 billion already frozen.
