FBI Blames North Korea for $6 Billion Binance Hack, Urges Firms to Block TraderTraitor Wallets

Published November 1, 2026, 04:15 AM PKT. Based on the FBI alert of October 31, 2026 (primary source), and reporting by CoinEdition, TokenPost, Coindoo and CoinDesk on October 31, 2026 (secondary sources). The FBI attribution names responsibility for the theft. It does not announce a recovery of stolen funds, a sanctions designation, or a court order, and Binance has not itself publicly named the attackers.

The FBI said on October 31, 2026 that North Korea was responsible for the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance on or about October 29, 2026. The bureau identified the activity as TraderTraitor, the name it uses for this specific North Korean malicious cyber activity, and published a long list of wallet addresses it says are holding or have held stolen assets and are operated by or closely connected to TraderTraitor actors. The announcement, issued with the US Secret Service and IRS Criminal Investigation, is the first formal attribution of this theft by the US government, and it turns a private-sector consensus into an official law enforcement position with a concrete request attached: block the money.

FBI names TraderTraitor for the October 29 theft

The FBI alert, dated October 31, 2026, states that the Democratic People's Republic of Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026, according to the bureau's own page. That figure sits alongside Binance's own estimate of about $6.3 billion in impact and TRM Labs' estimate of about $6.36 billion moved from Binance wallets across 10 blockchains, most of it in about 20 minutes. The three figures describe the same theft with different measurement scopes, not three separate losses. The FBI said it is releasing the information to advise the public of North Korea's responsibility, and it asked anyone with information to contact a local FBI field office or the Internet Crime Complaint Center at ic3.gov.

The timing matters. Private firms got there first. TRM Labs attributed the theft to TraderTraitor with high confidence, Chainalysis expressed a high degree of confidence in North Korean involvement, and US President Donald Trump had said investigators were examining a possible North Korean role, according to TokenPost and CoinEdition. Binance itself had said only that it was working with law enforcement to confirm the identity of the criminals. The FBI alert closes that gap at the official level. It also echoes the bureau's earlier TraderTraitor attribution for the February 2025 Bybit theft, then valued at about $1.5 billion, which makes this the second record crypto theft the FBI has pinned on the same activity in under two years, according to CryptoBriefing as reported in secondary coverage.

The block request: THORNode, RPC, DeFi and instant swaps

The FBI, the Secret Service and IRS Criminal Investigation urged private-sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder the stolen assets. The named categories are deliberate. THORNode operators run nodes for THORChain, a cross-chain swap protocol; RPC node operators run the infrastructure through which wallets and apps read blockchain data and submit transactions; instant exchanges and DeFi services are the venues where stolen coins can be swapped quickly into other assets. By addressing operators rather than only exchanges, the agencies are targeting the plumbing through which laundered funds move, not just the front doors where users trade.

The request is a law enforcement appeal, not a sanctions designation and not a court order, according to Coindoo's analysis of the alert. That distinction decides what happens next in practice. A firm that blocks a listed address is acting on a published law enforcement request and its own compliance judgment, while a sanctions designation would carry a legal prohibition with penalties. The FBI published the addresses itself, spanning ether, bitcoin and solana wallets according to TokenPost, so firms do not need to guess which wallets the bureau means. The list is long, running to hundreds of addresses on the FBI page, and firms that rely on blockchain analytics feeds will likely ingest it through their screening vendors rather than by hand.

Converted primarily into ether, headed for DeFi swaps

The agencies said they have observed TraderTraitor actors converting stolen assets primarily into ether, and they expect the assets to be further laundered by converting them using DeFi and instant swap services as the actors prepare them for further laundering stages. That sequence, theft, consolidation into ether, then repeated swaps through decentralized and instant-exchange venues, matches the laundering pattern seen after the Bybit theft, when stolen ether was spread across thousands of addresses and swapped repeatedly. It also explains why the block request names DeFi and instant-swap operators specifically: once funds enter a swap, the trail fragments, and each additional hop makes recovery harder.

One accidental obstacle briefly slowed that process on October 31, 2026. Chainalysis said an Ethereum block reorganization caused THORChain to issue a duplicate refund to someone who had deposited 10 ether, which inadvertently delayed the laundering of a significant amount of funds stolen from Binance and triggered an emergency pause on THORChain, according to Coindoo. A THORChain pause halts the network or a chain, it does not let operators remove a single swap, which is why the FBI's request to node operators is framed as blocking transactions rather than reversing them. The incident is a delay, not a recovery, and no source has quantified how much of the stolen funds it held up.

What the attribution does not do: recovery, withdrawals, reserves

Attribution and recovery are different things, and the numbers in this story must not be merged. Binance said on October 31, 2026 that it had replenished about 90% of the stolen cryptocurrency using company funds, with customer holdings of bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC now fully backed, according to CoinDesk. That is replacement funding from Binance's corporate treasury, its futures insurance fund and a partial deployment of its SAFU emergency reserve, not a recovery of 90% of the stolen coins from the attackers. Separately, about $3 billion in stolen assets had been frozen onchain with help from token issuers and other firms, according to CoinDesk and CryptoBriefing. The frozen figure and the replenished figure overlap in purpose but describe different actions, and neither figure means customers have been made whole through recovered loot.

Two customer-facing milestones remain on their earlier schedule and are unaffected by the FBI alert itself. Binance remains on track to reopen withdrawals in phases on Sunday, November 1, 2026, subject to security checks, according to its October 31 update as reported by CoinDesk, with the phased restart still hours away at the time of this article's publication. Its full cryptographic proof of reserves, which would let users independently verify that their balances are included in Binance's reported liabilities, is expected by November 3, 2026, after a snapshot taken at midnight UTC on October 31. The FBI alert adds a law enforcement track to the story, the pursuit and blocking of the stolen funds, while the exchange track, replacement funding, frozen assets, phased withdrawals and the November 3 proof, continues on its own timetable.

This article is news reporting and is not investment advice.

Sources

• FBI, North Korea Responsible for $6 Billion+ Binance Attack (October 31, 2026, primary source for the North Korea attribution, the TraderTraitor name, the October 29 date, the conversion primarily into ether, the expected further laundering through DeFi and instant swap services, the block request to THORNode, RPC, instant exchange, DeFi and analytics operators, and the published address list)
• CoinEdition, FBI Links $6.3B Binance Hack to North Korea, Warns Crypto (October 31, 2026, secondary source for the October 31 alert date, the DeFi laundering warning, Chainalysis's high-confidence assessment, the approximately $3 billion frozen figure, the 90% replenishment figure, and the November 1 withdrawal target)
• TokenPost, FBI Attributes More Than $6 Billion Binance Theft to North Korea (October 31, 2026, secondary source for the hundreds of published addresses spanning ether, bitcoin and solana, the earlier Trump statement on a possible North Korean role, and the joint FBI, Secret Service and IRS Criminal Investigation attribution)
• Coindoo, FBI Confirms North Korea Behind Binance Hack, Seeks Blocks (October 31, 2026, secondary source for the alert as a request rather than a sanctions designation or court order, the THORChain pause limitation, and the Chainalysis account of the October 31 THORChain duplicate refund delay)
• CoinDesk, Binance Says It Has Replaced 90% of Stolen Crypto After Massive $6.3 Billion Breach (October 31, 2026, secondary source for the 90% replenishment figure, the 10 fully backed tokens, the midnight UTC October 31 proof of reserves snapshot, the November 3 full cryptographic proof target, the SAFU restoration commitment, and the November 1 phased withdrawal target)