The Federal Bureau of Investigation (FBI) has officially released its preliminary investigative findings regarding the Binance exchange breach, confirming that a notorious state-sponsored North Korean hacker group is behind the largest digital asset theft in history. The FBI’s announcement, cited by Reuters on October 31, 2026, marks a major turning point in identifying the perpetrators of this severe security incident.
The TraderTraitor hacker group and traces of asset conversion to Ethereum
According to the FBI’s investigation records, the direct perpetrator of the attack that drained more than $6.3 billion from Binance is the cyber unit named TraderTraitor (also known by identifiers linked to the Lazarus cybercrime organization). This is a professional hacking group that has previously carried out numerous cryptocurrency thefts worth hundreds of millions of dollars to fund Pyongyang’s financial programs.
US law enforcement stated that federal monitoring teams detected members of this group aggressively converting the stolen funds into Ether. The FBI warned that the group is executing subsequent steps in a complex money-laundering process using decentralized technologies and cross-chain bridges, echoing the playbook previously used by cybercriminal groups when transferring stolen funds through Tornado Cash in past operations.
Expanding the investigation from self-destructing malware to transaction signing infrastructure
The FBI’s findings add crucial missing pieces to Binance’s previous technical notices. CEO Richard Teng previously acknowledged that this was a sophisticated attack originating from a personal computer compromised with malware capable of wiping its own data and traces clean after completing withdrawal orders.
The involvement of state-sponsored criminal organizations explains how the scale of damage managed to bypass standard security checkpoints to turn into a hot wallet hack of over $6 billion that shook the world. The hacker group skillfully exploited authorization vulnerabilities and automated delegation processes to drain liquidity without triggering the system’s emergency lockup alerts during the initial hours.
International coordination to freeze fund flows and geopolitical pressure
In response to the attackers’ ongoing asset dispersal, the FBI stated that it is coordinating closely with international exchanges, on-chain analytics firms, and stablecoin issuers to blacklist associated wallet addresses globally. Authorities also urged the decentralized finance (DeFi) protocol community to step up monitoring of suspicious transactions originating from the attack.
The FBI’s intervention elevates the incident from a standard corporate security breach to a complex matter of national security and geopolitics. As the drained funds risk being channeled to finance sanctioned activities, financial regulators worldwide will undoubtedly tighten identity verification oversight and cross-chain fund flow controls across all centralized exchanges in the coming period.