North Korea was behind the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance, the Federal Bureau of Investigation said on Saturday, October 31, naming a Pyongyang-linked hacking operation known as TraderTraitor.
According to the FBI alert, issued on October 31, North Korea was responsible for the theft from Binance on or about October 29, 2026. The announcement settles a question that had hung over the case since the attack, because blockchain analytics firms had already linked the theft to TraderTraitor before the United States government confirmed it publicly.
Attribution matters because the Binance theft is the largest cryptocurrency heist on record, and the FBI’s statement now puts North Korea behind both the biggest and the second-biggest crypto thefts ever, after the $1.5 billion Bybit hack of February 2025, which the bureau also blamed on TraderTraitor.
Working with the United States Secret Service and the Internal Revenue Service’s Criminal Investigation division, the FBI said it had observed TraderTraitor actors converting the stolen assets primarily into Ethereum. The bureau said it expects the hackers to launder the funds further through decentralised finance services and instant swap platforms.
As part of the alert, the FBI published an extensive list of cryptocurrency addresses it said were holding, or had previously held, assets connected to the theft, including Ethereum, Bitcoin and Solana wallets. The bureau urged cryptocurrency companies, blockchain analytics firms, decentralised finance services, instant exchanges and other virtual-asset providers to block transactions involving those addresses.
That appeal is a request, not a sanctions designation or a court order, according to reporting on the alert, which means each company still needs its own legal basis to act. The bureau also directly named THORNode operators, putting THORChain’s design under scrutiny.
Binance has said about $6.3 billion was taken in the attack. Blockchain analytics firm TRM Labs estimated that about $6.36 billion moved out of Binance wallets across ten different blockchain networks, with most of the transfers completed in roughly 20 minutes.
Binance said on Friday that approximately $3 billion in stolen assets had been frozen on-chain through cooperation with law enforcement, blockchain companies and industry partners. The company has set aside more than $6.34 billion in corporate funds to cover the stolen assets, drawing on its Secure Asset Fund for Users, its Futures Insurance Fund and its corporate treasury, and said it had replenished about 90 percent of the stolen amount.
Binance co-founder Yi He said the exchange would allocate 50 percent of its Secure Asset Fund for Users to cover losses from the hack, while keeping the remaining half in the fund. Binance had earlier said withdrawals, paused since the attack, should restart by November 1, and that user assets are safe.
Binance co-chief executive Richard Teng called the incident a complex attack. According to reporting on the company’s account, the breach involved both the hacking of an engineer’s laptop and the exploitation of a flaw in the exchange’s transaction approval system.
TraderTraitor is a name the FBI has used before for North Korean hacking activity. The bureau previously blamed the same operation for the Bybit theft in February 2025, then the biggest crypto theft ever, and analytics firms TRM Labs and Chainalysis had linked the Binance attack to TraderTraitor shortly after it happened, before the FBI announcement.
Chainalysis said on Saturday that an outage on THORChain after an Ethereum glitch had inadvertently delayed the laundering of a significant amount of funds stolen from Binance.
Whether the frozen funds can be recovered in full remains unclear, and the FBI said its work with the Secret Service and IRS Criminal Investigation to track the stolen assets and disrupt the laundering operation continues. The bureau urged anyone with information about the Binance theft or North Korean cryptocurrency laundering to contact a local FBI field office or submit a report through its Internet Crime Complaint Center.
