FBI Blames North Korea for $6B+ Binance Theft

What happened

The alert was issued by the FBI together with the US Secret Service and IRS Criminal Investigation. The FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about Oct 29, and refers to this specific North Korean malicious cyber activity as TraderTraitor. The FBI said it has observed the actors converting stolen assets primarily into Ether, and expects them to launder the funds further through decentralized finance platforms and instant swap services in preparation for further laundering stages.

The alert includes a list of wallet addresses holding or having held assets from the theft, described as operated by or closely connected to TraderTraitor actors. The FBI, the Secret Service and IRS Criminal Investigation urged THOR node operators, RPC node operators, instant exchanges, decentralized finance services, blockchain analytics firms and other virtual asset service providers to block transactions with or derived from the listed addresses.

Binance has resumed customer withdrawals. The Register reported that Binance says it has replenished about 95 percent of the stolen assets, with the remaining tokens harder to replace because of limited liquidity; after withdrawals resumed, Binance recorded approximately $3.64 billion in net outflows, about 2.1 percent of its reported assets. Totals differ by source: the FBI put the theft at more than $6 billion, Binance at about $6.3 billion, TRM Labs at $6.36 billion and Elliptic at $6.43 billion, with Elliptic saying $2.85 billion has been verified as frozen or seized, all figures as reported by the respective parties.

Key facts

1. Publisher and date: the FBI, issuing a cyber alert on Oct 31, 2026, jointly with the US Secret Service and IRS Criminal Investigation
2. Attribution: the FBI named North Korea as responsible and called the activity TraderTraitor; The Register reported the group is linked to the Lazarus Group
3. Timing and scale: on or about Oct 29, 2026, with the FBI putting stolen virtual assets above $6 billion; other estimates range from $6.3 billion to $6.43 billion
4. Laundering: the FBI observed stolen assets converted primarily into Ether, expected to move further through decentralized finance and instant swap services
5. Blocking call: the FBI and partners urged node operators, exchanges, decentralized finance services, blockchain analytics firms and virtual asset service providers to block transactions tied to the listed addresses
6. Binance and freezes: Binance has resumed withdrawals and says about 95 percent of stolen assets have been replenished; Elliptic says $2.85 billion has been frozen or seized, as reported