FBI links $6 billion Binance theft to North Korea

On October 31, the FBI blamed North Korea’s TraderTraitor for stealing more than $6 billion in virtual assets from Binance on or about October 29, 2026. The attribution puts a state-linked cybercrime group behind the largest crypto theft reported to date, and shifts attention to whether the stolen funds can be traced or frozen as they move.

The FBI said its investigation found the attackers converting the assets primarily into Ether (ETH), and warned that they may use decentralised finance services and instant swaps for further laundering. In its October 31 alert, the bureau urged exchanges, node operators, DeFi services and other virtual asset providers to block transactions linked to addresses it identified as connected to TraderTraitor.

How did the attackers move the assets?

Chainalysis estimated the theft at about $6.4 billion, with funds leaving Binance hot wallets across multiple blockchains from around 4:20 p.m. ET on October 29. Its account of the incident says the Ethereum attack used an operational wallet funded through Tornado Cash to submit signed authorisations that let a Binance hot wallet run attacker-deployed code and sweep assets to attacker-controlled addresses. Other affected wallets appeared to send funds through ordinary signed transfers.

That distinction matters because the theft did not rely on one uniform transaction path. The compromised Ethereum wallet executed attacker code, while other transfers appeared valid at the wallet level. Chainalysis said attackers rapidly moved stablecoins—whose issuers can freeze them—toward assets that cannot be frozen by an issuer. Over nearly 20 minutes, one wallet swapped $325 million in stablecoins for $285 million in ETH; freezes began at about 5:14 p.m. ET, according to the firm’s on-chain analysis.

What can investigators and exchanges still stop?

The FBI’s alert names several points where private-sector intervention could disrupt laundering: instant exchanges, DeFi services, THORNode and RPC operators, blockchain analytics firms, and other virtual asset service providers. It asked them to block transactions “with or derived from” the listed addresses. That request reaches beyond the first wallets that received the stolen funds, since later swaps and transfers may carry assets onward through new addresses and services.

Chainalysis reported that roughly $2.8 billion had been frozen by 11:30 a.m. ET on November 3. The figure is a snapshot of funds frozen by that time, not a final recovery total; the investigation and tracing were still under way. The FBI likewise described further conversion through DeFi and instant swap services as an expected next step, rather than confirming that all the stolen assets had already entered those channels.

How much of the loss will Binance customers bear?

Binance said it had enough of the same digital currencies set aside to cover 90% of the missing assets and promised customers full reimbursement, according to the Associated Press. That commitment addresses customer losses at the exchange, while the FBI’s request and blockchain tracing efforts concern the movement and potential freezing of the stolen assets. The two measures do not establish how much crypto will ultimately be recovered.

The FBI’s public attribution identifies TraderTraitor as responsible, while the operational picture remains focused on tracing funds across chains and services. For crypto firms, the immediate test is whether exchanges, token issuers and infrastructure operators can coordinate quickly enough to interrupt those conversions before the assets move beyond their control.

Sources and documents

• October 31 alert — fbi.gov
• on-chain analysis — chainalysis.com