01.11.2026 12:34
The U.S. Federal Bureau of Investigation (FBI) announced that the North Korea-linked TraderTraitor hacker group was behind the $6.3 billion cryptocurrency theft targeting Binance. It was stated that the stolen assets were being converted into Ethereum in an attempt to launder them, while crypto exchanges were called on to block suspicious transactions. U.S. President Donald Trump, regarding North Korea's role in the attack, said, "We don't know. We are investigating."
Binance, the world's largest cryptocurrency exchange by trading volume, was the target of a massive cyberattack carried out on October 29, 2026.
It was determined that digital assets worth approximately $6.3 billion were seized in the attack. The incident is considered one of the largest theft cases not only in the cryptocurrency sector but also in the history of cybercrime.
US officials announced that North Korea-linked cybercrime groups were behind the attack. With the FBI's statement on October 31, suspicions previously raised by private security companies turned into an official accusation.
FBI OFFICIALLY HELD NORTH KOREA RESPONSIBLE
The FBI announced that the attack was carried out by the North Korea-linked group known as TraderTraitor.
In investigations conducted together with the US Secret Service and the criminal investigation unit of the US Internal Revenue Service, it was determined that the attackers had begun converting the assets they stole into different cryptocurrencies.
The FBI stated that the stolen digital assets were being converted especially into Ethereum and that these transactions could be the first stage of a broader process aimed at obscuring the money trail.
Officials warned that the attackers could continue converting the funds they seized into different assets through decentralized finance platforms and fast swap services.
THEY ARE TRYING TO OBSCURE THE MONEY TRAIL
One of the most striking details in the FBI's statement was the findings regarding how the attackers moved the assets they stole.
Although cryptocurrency transactions are recorded on the blockchain, attackers can make tracking difficult by transferring funds to different wallets, networks, and digital assets.
In this method, the stolen cryptocurrencies are first converted into other assets and then transferred repeatedly through different services. The aim is to complicate the connection between the addresses from which the assets were initially stolen and subsequent transactions.
The FBI asked cryptocurrency exchanges, blockchain analysis companies, and other digital asset service providers to block transactions linked to suspicious wallets. As part of the investigation, the movements of the stolen funds continue to be monitored.
THE ATTACK TOOK PLACE IN APPROXIMATELY 20 MINUTES
According to an assessment by cybersecurity company TRM Labs, the attackers carried out asset transfers from Binance-owned wallets across 10 different blockchain networks.
It was stated that most of the stolen digital assets were transferred to different addresses within about 20 minutes.
The company linked the attack with a high level of confidence to the North Korea-linked TraderTraitor group.
The movement of such a large amount of digital assets in a short time was one of the important details revealing the scale and coordination of the attack.
BINANCE COVERED 90 PERCENT OF THE LOSSES
After the attack, attention turned to the steps Binance would take toward its users.
The company announced that it would cover all of the approximately $6.3 billion in stolen assets from its own resources. According to information provided by Binance, about 90 percent of the losses had been compensated.
The company reported that the remaining 10 percent consisted of digital assets with lower liquidity and that reacquiring them could take time.
Binance also announced that it planned to resume withdrawals, which had been suspended after the attack, as of November 1.
In the company's statement, it was emphasized that all damages would be covered so that users would not suffer financial loss due to the attack.
TRUMP'S STATEMENT ON NORTH KOREA
Although the FBI directly held North Korea responsible, US President Donald Trump made cautious statements regarding the country behind the attack.
While answering journalists' questions at the Mar-a-Lago estate in Florida, Trump said, "I'm not worried. We're looking into the matter. We don't know whether it's North Korea, but if it is, we will discuss this with North Korea." Trump's statement came after the FBI held the North Korea-linked group responsible.
The cyberattack, which occurred at a time when the US President raised the possibility of meeting again with North Korean leader Kim Jong Un, also brought discussions about Washington-Pyongyang relations. Trump and Kim Jong Un had met three times during the US President's first term.
THE SAME GROUP ALSO STOLE $1.5 BILLION IN 2025
The name of the TraderTraitor group, which the FBI held responsible, had previously been associated with cryptocurrency thefts worth billions of dollars. The group was held responsible for the theft of digital assets worth approximately $1.5 billion from the cryptocurrency exchange Bybit in February 2025.
In a security advisory published on February 26, 2025, the FBI announced that the Bybit attack was carried out by North Korea.
It had also been stated at that time that the attackers tried to cover their tracks by distributing the stolen cryptocurrencies across thousands of different addresses.
The size of the latest attack on Binance reached approximately four times that of the Bybit incident.
WHO IS THE TRADERTRAITOR GROUP?
TraderTraitor is one of the names used by US authorities to describe North Korea-linked cyber operations.
The group is associated with attacks targeting cryptocurrency exchanges, digital asset companies, and technical personnel working at these organizations.
According to cybersecurity research, the methods used by the group include fake job offers designed to deceive employees, phishing attempts, and attacks on software supply chains.
In particular, targeting employees with access to critical systems can enable attackers to infiltrate companies' digital infrastructures. TraderTraitor is also associated with the Lazarus Group, which is assessed to have been operating internationally for many years.
US authorities claim that revenues obtained from North Korea-linked cyber operations can be used to circumvent international sanctions and provide resources for the country's weapons programs.
SHARP DECLINE IN THE CRYPTOCURRENCY MARKET
After the Binance attack came to light, sharp price movements were also experienced in the cryptocurrency market.
Following the attack news, the value of Bitcoin fell by about 5 percent, and the value of Ethereum fell by about 6 percent. In BNB, the native crypto asset of the Binance ecosystem, the decline reached about 10 percent.
The scale of the attack renewed concerns about the security of digital assets and the resilience of centralized cryptocurrency exchanges against cyberattacks.
Experts state that distributing stolen funds across different addresses can make tracking difficult, but the fact that blockchain transactions are recorded provides investigation teams with important data.
FATE OF BILLIONS OF DOLLARS REMAINS A MATTER OF CURIOSITY
After the FBI held North Korea responsible, the focus of the investigation is on the movements of billions of dollars' worth of stolen digital assets.
While Binance takes steps to compensate users for their losses, U.S. authorities continue to track the cryptocurrency wallets used by the attackers.
The efforts of cryptocurrency exchanges and blockchain analysis companies to prevent suspicious transactions are important in terms of how much of the stolen assets can be recovered.
.