Who Is TraderTraitor? FBI Identifies North Korean Hackers Behind the $6.3B Binance Attack

North Korean cyber actors known as TraderTraitor have been blamed by the FBI for a $6.3 billion (approximately £4.70 billion) theft from cryptocurrency exchange Binance, in what ranks among the largest reported crypto exchange hacks.

The agency's announcement on Saturday, 31 October 2026, came after an attack on the exchange on or about Thursday, 29 October. Binance said on Sunday it had covered approximately 95 per cent of the affected asset value.

The breach prompted Binance to suspend cryptocurrency withdrawals while it carried out security checks. Deposits remained available. The exchange has said it will absorb the financial impact rather than pass the losses on to customers, although its efforts to replace all the stolen assets remain unfinished.

Inside Tradertraitor, the Group Named by the FBI

TraderTraitor is a designation used by the FBI for North Korean malicious cyber activity targeting virtual assets. The agency's announcement attributed the Binance theft to North Korea but did not publicly identify individual perpetrators or establish precisely how they entered the exchange's systems.

The name predates the Binance incident. In February 2025, the FBI used TraderTraitor when attributing a separate theft of approximately $1.5 billion (approximately £1.12 billion) from cryptocurrency exchange Bybit to North Korea. The earlier attribution does not establish that the same individuals carried out both operations.

In its latest alert, the FBI said investigators working with the US Secret Service and the Internal Revenue Service's criminal investigation division had observed TraderTraitor actors converting stolen assets primarily into ether (ETH).

The agency expected further laundering through decentralised finance platforms and instant swap services. It urged cryptocurrency businesses and other service providers to block transactions linked to identified addresses.

North Korea has previously denied using state-linked cyber units for financial theft. Its diplomatic representatives did not respond to requests for comment on the Binance incident, according to Reuters.

How Hackers Breached Binance's Defences

Binance's account of the intrusion remains preliminary. On Friday, 30 October, the exchange said a compromised laptop belonging to a DevOps engineer might have allowed an attacker to enter a service container and submit unauthorised withdrawal transactions.

Binance later said investigators had identified additional possible points of breach.

The company said it had found no evidence that wallet private keys had been leaked. It has promised to publish a fuller technical report after its investigation is complete, leaving the precise sequence of events unresolved.

How Binance Is Covering TraderTraitor-Linked Losses

Binance said it had allocated more than $6.34 billion (approximately £4.73 billion) in company funds to cover losses. By Saturday it had replenished about 90% of the affected value; its Sunday update raised that figure to approximately 95 per cent.

The remaining 5% consists of less liquid cryptocurrencies outside the ten major tokens Binance said were fully backed. The exchange said it was buying replacement assets through market purchases and over-the-counter transactions, with the less liquid tokens taking longer to source.

Its funding plan draws on the Secure Asset Fund for Users (SAFU), its Futures Insurance Fund and the corporate treasury. Binance said it would restore SAFU to approximately $1 billion (approximately £746.44 million) after using part of the emergency reserve. It has not published a complete breakdown of the contributions from each source.

On Saturday, Binance co-CEO Richard Teng wrote on X: 'Our users will not bear the financial impact of this incident.'

Separately, Binance said it had worked with blockchain partners to freeze approximately $3 billion (approximately £2.24 billion) in affected assets on-chain. Freezing stolen cryptocurrency can prevent further transfers, but does not itself establish that the assets have been returned. Replenishing customer holdings using company resources is also different from recovering funds from the attackers.

Binance announced that withdrawals would resume progressively on Sunday, with the first phase scheduled between 06:00 and 09:00 GMT. The initial networks include Bitcoin, Ethereum, BNB Chain and Solana, alongside other supported networks and tokens. Further withdrawals depend on security and readiness checks; the announcement did not confirm that all services were restored.

The exchange also published a proof-of-reserves snapshot taken at 00:00 GMT on Saturday, covering BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. It said those balances were fully backed and expected the complete cryptographic proof, enabling independent verification at a minimum one-to-one ratio, by Tuesday, 3 November.