FBI says North Korea stole more than $6bn in the Binance hack

The FBI has blamed the Binance hack on North Korea. On Saturday, the bureau said North Korea stole more than $6bn in virtual assets from Binance, the world’s largest crypto exchange. The theft happened on or about 29 October.

In its statement, the FBI named the activity “TraderTraitor”. The FBI is working with the US Secret Service and the tax agency’s criminal investigators (IRS-CI). Together they have seen TraderTraitor actors converting the stolen assets mainly into ether (ETH), the Ethereum network’s token.

“It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages,” the FBI said in a statement.

The three agencies want crypto firms to block transactions linked to the hackers. They named THORNode operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms. The FBI listed hundreds of Ethereum addresses, 19 Bitcoin addresses and one Solana address that hold or held the funds.

The FBI is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as “TraderTraitor.”

The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.

How You Can Help:
FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.

A list of addresses associated with this activity is available here: https://t.co/g0oIWx0WeD

— FBI Cyber Branch (@FBICyberBranch) October 31, 2026

The group the FBI blamed for Bybit

The FBI previously blamed TraderTraitor for the theft of about $1.5bn from the Bybit exchange in February 2025. On Thursday, the analytics firms TRM Labs and Chainalysis had already tied the Binance theft to the same group.

Elliptic, another blockchain analytics firm, puts the haul at $6.43bn in its analysis. Binance’s own estimate is about $6.3bn.

“This single incident almost doubles the total cryptoassets stolen by the regime,” Elliptic wrote.

Elliptic believes actors linked to North Korea have stolen more than $6.5bn in cryptoassets in recent years. That includes more than $1bn it tracked in 2026 before the Binance hack.

In September, Bitget blamed suspected North Korean hackers for a $351.6m theft from its hot wallets. This month, the US charged 14 people over a scheme placing North Korean IT workers at over 70 companies. The country’s hackers are also building their own AI tools.

A day before the FBI statement, President Donald Trump said the US was looking into a North Korean link. Kevin Whitelaw reported his remarks for Bloomberg.

“I’ve always felt it was a little bit dangerous,” Trump told reporters in the Oval Office.

North Korea has denied involvement in hacks in the past, Osmond Chia and Angus Thompson reported for the BBC.

Withdrawals restart

Binance began restoring withdrawals in phases on Sunday, between 06:00 and 09:00 UTC, according to its recovery update. Phase one covers the networks and assets with the most user demand in the past week. More will follow as security checks finish. Deposits remain open, Binance said.

The exchange says it has now covered about 95% of the stolen amount, up from 90% on Saturday. It is buying the rest through market and over-the-counter deals. The last 5% are less liquid tokens outside its top ten. They take longer to buy in the amounts needed, Binance said.

Binance set aside more than $6.34bn of company funds. Part of the money came from its Secure Asset Fund for Users (SAFU), an emergency reserve, it said in a Saturday update. The rest came from its futures insurance fund and its corporate treasury. It plans to refill SAFU to about $1bn.

“Binance will absorb the financial impact of the stolen funds, not our users,” the company wrote.

Binance thanked the FBI’s cyber branch for its support in a post on X.

We sincerely thank @FBICyberBranch for their strong support during this challenging time.

— Binance (@binance) November 1, 2026

Binance expects to publish a full zero-knowledge proof of its reserves by Tuesday 3 November. Holders of its ten main tokens can then check that Binance holds at least one coin for every one they own.