The FBI said on October 31 that TraderTraitor, a North Korean state hacking group, carried out the roughly $6.3 billion Binance hack of October 29. Blockchain trackers had pointed to the same group. Binance reopened withdrawals on November 1, and customers have taken out a net $4.72 billion since. The group's usual way in is a fake recruiter who sends a coding test or app that plants malware.

Key facts

  • Who: TraderTraitor, the FBI's name for a North Korean state hacking group (also called Jade Sleet, UNC4899 and Slow Pisces)
  • What: The FBI named the group on October 31; it says the stolen funds were mostly swapped into ether and will likely be laundered further
  • How much: About $6.3 billion affected, per Binance; Binance says it has replaced about 95% with company money
  • When: Theft on October 29, 2026; withdrawals reopened in stages from November 1, bitcoin first
  • Source: NBC News on the FBI statement

The name attached to the Binance hack is now official. On October 31 the FBI said TraderTraitor, a North Korean state hacking group, was behind the roughly $6.3 billion theft of October 29, NBC News reported. Blockchain tracking firm TRM Labs had linked the theft to the same group with "high confidence" a day earlier, Cointelegraph reported.

The FBI said the hackers have been swapping the stolen coins mainly into ether, and it expects them to keep laundering the money through swap services and other decentralized finance (DeFi) tools. It asked crypto companies to block hundreds of addresses tied to the theft, CoinDesk reported. North Korea routinely denies stealing crypto.

Who TraderTraitor is

TraderTraitor is the FBI's name for one North Korean hacking operation. In February 2025 the FBI said the group stole about $1.5 billion from the exchange Bybit. That time too, the hackers moved fast, swapping stolen coins and spreading them across thousands of addresses before cashing out.

The same group was blamed for the $308 million theft from Japan's DMM Bitcoin in 2024. That case shows how it usually gets in.

The fake job offer

In the DMM case, the FBI and Japanese police said a hacker posed as a recruiter on LinkedIn. They contacted an employee at a wallet software company and sent a "pre-employment test," The Hacker News reported. The test was malicious code. Once it ran, the hackers had a way into the system that approved transfers.

Binance's own first explanation was a possibly compromised engineer's laptop. It still hasn't said how that happened, and it has found "additional points of breach" since.

Security researchers say these lures usually come through LinkedIn, Telegram or Slack. They offer a well-paid job and then a coding challenge, a PDF or a trading app to install. The targets are mostly people at crypto companies. Anyone who installs a stranger's file is at risk, though.

If you use Binance

  • Withdrawals are back, in stages. Bitcoin reopened first on November 1, with ether, XRP and dogecoin among the first batch, Business Standard reported. Binance hasn't given a date for the rest. Customers pulled a net $3.64 billion in the first nine and a half hours, about 2% of the exchange's assets, CNBC reported. By November 3 the total had reached a net $4.72 billion, CoinDesk reported. Check the app itself, not links in messages.
  • No one needs your login or codes to "refund" you. Binance says it has already replaced about 95% of the stolen amount with its own money, CNBC reported.
  • Treat surprise job offers with a test file as a warning. Never run a stranger's code or app on a computer that holds crypto or work logins.

We covered the first details in what happened in the Binance hack. If a "compensation" offer reaches you, our guide to fake wallet support shows how those pitches work.

Sources: NBC News, FBI says North Korea was behind the $6.3 billion Binance crypto hack (October 31, 2026), CoinDesk, FBI confirms North Korea's role in $6 billion Binance hack (October 31, 2026), Cointelegraph, Binance's record $6.3B crypto hack as it happened (October 30-31, 2026), FBI public service announcement I-022625-PSA, North Korea responsible for $1.5 billion Bybit hack (February 26, 2025), The Hacker News, North Korean hackers pull off $308M bitcoin heist from DMM (December 2024), Business Standard, Binance resumes crypto withdrawals after covering bulk of stolen $6.3 bn (November 1, 2026), CoinDesk, Bitcoin steadies as ETFs lose $399 million and Binance outflows hit $4.7 billion (November 3, 2026), CNBC, Binance sees $3.64 billion in net outflows as withdrawals resume after massive hack (November 2, 2026).