A threat group allegedly uses AI-assisted reconnaissance and phishing, moving stolen funds across blockchains while Binance replaces most losses
The Federal Bureau of Investigation (FBI) has attributed the US$6.3bn theft from Binance to TraderTraitor, an elite North Korean hacking unit, in what is the largest cryptocurrency heist on record.
In an alert issued on 31 October 2026, the bureau said North Korea “was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026”.
On 2 November 2026, Bloomberg reported that cybersecurity experts believe the group is now using AI to identify and compromise high-value targets. According to TRM Labs, the attacker has moved about US$6.36bn from Binance wallets across 10 blockchains, with most of the funds transferred in roughly 20 minutes.
Binance had initially announced an engineer’s laptop had been compromised, then later identified “additional points of breach.” Working with the Secret Service and IRS Criminal Investigation, the FBI said the hackers were converting the stolen assets primarily into Ethereum and published more than 600 wallet addresses connected to the theft, according to SecurityWeek. Binance has replaced about 90% of the stolen amount and resumed withdrawals. The FBI has also linked TraderTraitor to the US$1.5 billion Bybit hack in February 2025.
Experts cited by Bloomberg say TraderTraitor may have only about a dozen members. They believe the group uses AI to locate high-value crypto businesses to compromise, an approach known as “big game hunting.” TRM Labs has said the group’s new techniques suggest heavy AI use. However, AI’s role in the Binance attack has not been confirmed; Bloomberg presents it as the experts’ assessment. Experts believe AI is mainly used for reconnaissance and targeted phishing. President Donald Trump has warned that “the bloodbath of AI hacking is to come”, according to a Bloomberg analysis.
North Korea has not responded to the FBI’s attribution. Lim Jong-in of Korea University had told SBS that the North “trains 100 top-tier hackers every year.”
