FBI Blames North Korea for $6B Binance Crypto Theft

TRM reported that roughly $6.36 billion left Binance wallets across ten blockchains, with most of it gone within 20 minutes of the first transfer at 20:05 UTC. That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025. Binance confirmed a security incident and temporarily suspended withdrawals on several networks.

Attackers reportedly got in through an engineer’s laptop, which let them submit unauthorized withdrawal requests. Binance says no wallet private keys were compromised.

Only Part of the Money Was Frozen

The FBI, working with the U.S. Secret Service and IRS Criminal Investigation, says TraderTraitor operators are converting the stolen assets mainly into Ethereum and are expected to push them through DeFi protocols and instant swap services.

Early freezes recovered some ground:

• Tether, Circle, Ripple, and World Liberty Financial froze about $2.67 billion in stablecoins
• Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, roughly $2.7 billion

The attackers moved quickly anyway. They sold USDT to market makers and borrowed ETH against USDT on Aave, and now hold more than 420,000 ETH and 18,270 BTC. About $2.4 billion sits beyond the reach of any token issuer.

The alert asks THORNode operators, RPC node operators, instant exchanges, DeFi platforms, and blockchain analytics firms to block transactions involving identified TraderTraitor addresses, including any funds derived from them. The full address list is in the FBI’s statement.

Hashlytics Take

The detail worth sitting with is the combination of a compromised engineer laptop and Binance’s claim that no private keys were exposed. Both can be true, and together they point to the weak spot: not the cryptography guarding the wallets, but the workflow that decides who can ask for a withdrawal. Stolen keys are a custody failure. A laptop that can originate withdrawal requests is an authorization failure, and the second kind is far easier for a patient state actor to reach. The recovery picture reinforces this. Freezes only work on assets that issuers or protocols control, and the attackers’ fast swap into ETH and BTC shows they planned for exactly that. Expect the industry conversation to shift from securing keys to limiting what any single endpoint can approve.