TLDR
- Binance lost $6.3 billion last week in the largest crypto theft on record, and the FBI blames North Korea.
- Blockchain firms link the attack to TraderTraitor, a unit that began its Binance attack with a fake job interview.
- Reuters reports North Korea picks about 150 to 200 children a year to study computer science.
- Successful hackers can earn perks such as apartments in Pyongyang, according to defectors and analysts.
- Pyongyang denies involvement, and Kim Yo Jong called the FBI finding “absurd rhetoric.”
Binance lost $6.3 billion in a theft last week. It is the largest crypto heist in history. The FBI and several analysis firms have attributed it to a North Korean hacking group called TraderTraitor.
The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North… pic.twitter.com/TBUvUFln4n
— FBI Cyber Branch (@FBICyberBranch) October 31, 2026
The theft is more than four times the $1.5 billion taken from Bybit in February 2025. The FBI also blamed TraderTraitor for that attack. The Binance theft roughly doubled the more than $6 billion that TRM Labs estimated in April that North Korean hackers had stolen since 2017.
How the Binance attack started
Binance Chief Security Officer Jimmy Su said a software engineer was contacted in September by someone posing as a project director. A purported human resources representative then interviewed the engineer. That person shared a social media account with personal photos to build trust.
A second interview, with a supposed CEO, ended with instructions to download a coding assignment onto the engineer’s work computer. The file contained malware. Binance said attackers later used that machine and an internal AI tool to take control of systems.
Ari Redbord of TRM Labs said the group “goes after people before it goes after code.” He said it stages an attack for weeks, waits, and then moves everything at once. Tom McLouth of Chainalysis said the group exploits trust, not just technology.
The same method appeared in earlier cases. In March 2024, someone posing as a LinkedIn recruiter sent an employee of Japanese firm Ginco a coding test with hidden malicious code. That led to the theft of about 4,503 bitcoin, worth $308 million, from Japanese exchange DMM Bitcoin. The platform later closed.
Chainalysis said its strongest evidence was that stolen Binance funds were combined with proceeds from September’s roughly $388 million Bitget hack. That hack was also attributed to North Korea. Chainalysis and TRM both attributed the Binance theft to TraderTraitor with a high degree of confidence.
Pyongyang denies the claims. Kim Yo Jong, the sister of leader Kim Jong Un, dismissed the FBI’s finding as “absurd rhetoric.” Reuters notes that North Korea has dismissed such blame for years as political provocation.
Where the hackers come from
Reuters reports that North Korea set up a cyber unit in 1998. Kim Jong Un declared in 2013 that cyber warfare was an “all purpose sword,” alongside nuclear weapons and missiles. Defectors and analysts say the country picks about 150 to 200 children a year, starting at age 11 or 12, to study computer science.
At 17, top students go to the country’s best universities. After more screening, a few enter the military’s cyber unit. Training covers cryptocurrency protocols, reverse-engineering hardware, advanced math, and foreign languages. Those who do not become hackers are trained to build software or apps for Western firms through remote jobs.
Kim Heung-kwang, a defector who trained hackers for the state before fleeing in 2004, said it does not matter whether a child wants to be a hacker. A multilateral monitoring group places TraderTraitor within the Reconnaissance General Bureau’s 110 Research Institute. Redbord described the system as similar to how Russia once built gymnasts.
Successful hackers can receive perks. Kim said their military unit can earn as much as 30% of a heist’s profits in U.S. dollars. Professor Lim Jongin of Korea University said there are accounts of hackers receiving apartments in Pyongyang as large as 132 square meters. One defector said top performers can also join the ruling party.
South Korea’s National Intelligence Service estimated in 2024 that North Korea’s cyberwarfare operations employ about 8,400 people. Advocacy group PSCORE reported that former IT workers describe cramped housing, workdays longer than 10 hours, and constant surveillance. Monthly dollar targets must be met or workers face punishment.
Analysts also point to AI use. A sanctions monitoring team said in 2025 that TraderTraitor had obtained ChatGPT and DeepSeek accounts. Chainalysis analyst Alec Zebrick said the group is leaning toward “big game hunting,” meaning larger targets with bigger vaults.
On Nov. 4, 2026, South Korean television aired reports on Kim Yo Jong’s denial of the Binance accusation, and the FBI and Binance maintain that North Korea was responsible.
