FBI Attributes $6 Billion-Plus Binance Hack to North Korea

The FBI on Oct. 31 attributed the theft of more than $6 billion from Binance to North Korea and urged crypto infrastructure operators to block transactions tied to the attackers.

In an alert published on its website, the bureau said North Korea “was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.” It calls the activity “TraderTraitor.”

The official attribution follows the Chainalysis assessment The Defiant reported on Oct. 30. The analytics firm said it had a “high degree of confidence” that North Korea was responsible after observing stolen Binance funds commingling with proceeds of last month’s Bitget exploit. Its CEO, Jonathan Levin, had described TraderTraitor’s involvement as “likely.”

The FBI said it and its Secret Service and IRS criminal-investigation partners had observed the actors converting stolen assets primarily into ether. It expects further laundering through DeFi and instant-swap services. The agencies urged THORNode operators, RPC node operators, instant exchanges, DeFi services and other crypto businesses to block “transactions with or derived from” the addresses listed in the alert, extending the request to downstream funds.

A Block Request, Not a Recovery Order

Binance estimated the loss at approximately $6.3 billion and said in its Oct. 30 update that roughly $3 billion had been frozen onchain, with recovery efforts still to follow. The FBI alert does not announce a sanctions designation or authorize the return of those frozen assets.

Where OFAC sanctions require virtual currency to be blocked, the Treasury agency’s guidance says U.S. holders must deny access to it. Unblocking and returning that currency requires OFAC authorization or the end of the legal prohibition.

Binance’s replacement of stolen tokens is a separate effort. In its Oct. 31 recovery update, the exchange said it had replenished 90% of the stolen assets and was buying the remaining, less-liquid tokens through market and over-the-counter channels. It reiterated that users would not bear the financial impact.

Binance said on Oct. 30 that it expected further verified technical findings within about 48 hours and promised a detailed post-mortem. Its Oct. 31 update kept Nov. 1 as the withdrawal restart target; the exchange previously said reopening would be phased and conditional on completing security checks.