FBI: North Korea Responsible for $6 Billion+ Binance Theft
The Federal Bureau of Investigation (FBI) released a cybersecurity advisory on October 31 formally attributing the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance to North Korea. The theft took place on or about October 29, 2026, and the FBI refers to this North Korean malicious cyber activity as TraderTraitor.
Blockchain analytics firm TRM Labs had previously assessed that the attack came from the North Korean TraderTraitor group, while Binance said its own investigation had not confirmed the attacker's identity, and the FBI and U.S. Secret Service involvement had already been reported. The advisory is the first official attribution of the case by U.S. law enforcement.
The FBI said that, together with the U.S. Secret Service (USSS) and IRS Criminal Investigation (IRS-CI), it has observed TraderTraitor actors converting the stolen assets primarily into Ethereum (ETH). The assets are expected to be further laundered by converting them using DeFi and instant swap services.
The three agencies urged private-sector entities, including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers, to block transactions with or derived from the addresses the actors are using to launder the stolen assets. The advisory lists a long series of Ethereum addresses that are holding or have held assets from the theft and are operated by or closely connected to North Korean TraderTraitor actors.
The FBI said it remains committed to identifying, mitigating and disrupting North Korea's illicit cybercrime and virtual asset theft, and asked anyone with information to contact a local FBI field office or the FBI's Internet Crime Complaint Center at ic3.gov.
The case is the largest cryptocurrency theft on record. Binance has said the incident affected an estimated $6.3 billion, that about $3 billion in affected assets had been frozen on-chain by partners, and that it would cover all losses through its Secure Asset Fund for Users (SAFU) and company funds.
Source: GSM · USA (original Chinese edition)
Photo: 图：位于华盛顿的美国联邦调查局（FBI）总部胡佛大楼。GSM自家图库联邦素材包固定图。 / The J. Edgar Hoover Building, FBI headquarters in Washington. GSM federal asset-pack file photo.
- 2026-10-29$6.3 Billion Stolen: Binance Suffers Largest Crypto Theft in History, About $3 Billion Frozen, Exchange Pledges Full Reimbursement
- 2026-10-30Follow-Up: FBI and US Secret Service Join Binance Hack Probe as Signing System Breach Emerges and $2.4 Billion Is Feared Beyond Reach
- 2026-10-30Follow-Up: After the $6.3 Billion Binance Theft, CFTC Chair Offers Exchanges a Federal Registration Option
- 2026-10-31FBI: North Korea Responsible for $6 Billion+ Binance TheftThis story
- 2026-10-31Musk Mocks Binance's $6.3 Billion Hack on X: CZ Tells Him to Stop and Cites a $1 Billion SpaceX Stake
