The FBI has blamed North Korea for the record $6.3 billion theft from cryptocurrency exchange Binance, saying a North Korean hacking group known as TraderTraitor carried out the attack and is now laundering the stolen assets, mainly by converting them into Ethereum.
In a statement issued on Saturday, the FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about 29 October 2026. It urged crypto businesses to block transactions linked to hundreds of wallet addresses connected to the group. Binance, meanwhile, said it has already replaced 90% of the stolen funds with company money and will cover the full loss itself, not its users.
What the FBI said
The FBI’s statement was short but unusually direct. It said the bureau was “releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.”
It named the operation TraderTraitor and said it had observed TraderTraitor actors converting stolen assets primarily into Ethereum. It added that the assets are expected to be laundered further, in stages, using decentralised finance services and instant swap services that let users exchange one cryptocurrency for another quickly and with few questions asked.
The statement was issued jointly with partners at the US Secret Service and IRS Criminal Investigation. Together, the agencies urged a long list of private-sector players — including THORNode operators, RPC node operators, instant exchanges, decentralised finance services, blockchain analytics firms and other virtual asset service providers — to block transactions with, or derived from, the addresses TraderTraitor actors are using.
Hundreds of addresses published
Alongside the attribution, the FBI published a list of wallet addresses it said currently hold, or at some point held, funds from the hack. According to the bureau’s notice, the list contains more than 600 Ethereum addresses, just under 20 Bitcoin addresses and a single Solana address.
That list matters because cryptocurrency transactions are recorded on public blockchains. Once an address is flagged, exchanges and analytics firms can watch it, freeze connected funds where they have the power to do so, and refuse to process transfers that touch it. Stablecoin issuers had already frozen more than $2.4 billion of the stolen funds before the FBI statement, according to CoinDesk’s reporting.
But the list is only a starting point. Chainalysis, a blockchain analytics firm, said the attackers had already used “thousands of addresses” and warned that the number could grow into the tens of thousands in the coming weeks as the money moves through a wider laundering network. Its chief executive, Jonathan Levin, said the attackers were using novel automated laundering mechanisms, circulating funds between addresses to obscure the trail before sending them onwards, and that the sheer size of the haul meant trusted laundering venues alone could not handle it.
Who is TraderTraitor?
TraderTraitor is the name US authorities give to a specific North Korean malicious cyber operation. It is the same group blamed for a $1.5 billion theft from the Bybit platform in February last year, an attack that was itself the largest crypto exchange theft on record at the time. The Binance theft, at about $6.3 billion, is more than four times larger.
TraderTraitor is believed to be part of the Lazarus Group, a wider North Korean hacking apparatus that has been linked to a string of high-profile breaches over more than a decade, including the 2014 hack of Sony Pictures. US officials have long argued that North Korea, which faces extensive international sanctions over its nuclear and missile programmes, uses cyber theft as a way to capture revenue outside the formal financial system.
That context is also why the attribution carries weight beyond the crypto industry. The sheer scale of the hack has put a fresh spotlight on how a heavily sanctioned state can move billions of dollars through decentralised systems that were designed to operate without a central authority.
What Binance says: 90% replaced, users covered
Binance moved quickly to reassure customers. In a statement on Saturday, the exchange said it had used company funds to buy tokens to replenish 90% of what was stolen. The money came from its $1 billion Secure Asset Fund for Users (SAFU), a Bitcoin reserve fund it holds to protect customers in the event of security breaches, along with some of its Futures Insurance Fund and its corporate treasury.
The remaining 10% consists of less liquid tokens, Binance said, meaning they may take longer to buy in the required amounts. The company said it would keep buying the remaining tokens until coverage reaches 100% for all of them, and repeated its pledge in plain terms: “Binance will fully cover the financial impact of the funds stolen in this incident.”
Binance had suspended user withdrawals after the hack. In its latest update on Saturday, it said withdrawals were on track to resume on Sunday. It also announced a new proof-of-reserves snapshot, allowing users to independently verify that their assets are backed at a minimum 1:1 ratio.
Binance co-chief executive Richard Teng had described the breach on Friday as a “complex attack” involving a compromised laptop and malicious software designed to delete evidence of its activity, making it hard to trace and investigate. The exchange later described the incident as having several “points of breach.”
Why it matters
First, the attribution turns a suspected culprit into an official US government finding. Before Saturday, private investigators and analysts had already pointed to TraderTraitor, but the FBI statement is the first official confirmation by US authorities, and it comes with a concrete enforcement ask: block the flagged addresses.
Second, the case shows how fast stolen crypto can move. Binance lost about $6.3 billion in the biggest crypto theft on record, with most of the funds drained within roughly 20 minutes, according to blockchain analysts. Within days, much of it had already been converted, frozen, re-bought or pushed through swap services — a race between investigators and launderers playing out in public, on-chain, in real time.
Third, the hack rattled markets. Crypto prices fell sharply on Friday as news of the breach spread, with Bitcoin dropping nearly 5%, Ethereum nearly 6% and BNB, Binance’s own token, falling nearly 10%, according to market reporting of the day’s moves.
Trump: “We’re learning about it”
Asked about the hack on Saturday night, US President Donald Trump struck a more cautious note than the FBI. Appearing at a Halloween party at his Mar-a-Lago estate in Florida, he told reporters investigators were not yet certain about North Korea’s role.
“We’re learning about it,” he said, adding that he was not concerned and that his administration would “talk to North Korea about it.” He also said, “We don’t know if it’s North Korea,” while adding that it could yet be determined that it was.
The contrast between the president’s remarks and the FBI’s firm attribution is now part of the story, and it leaves open how the US government will follow up diplomatically with Pyongyang, beyond the law-enforcement action already taken.
Timeline
- 29 October 2026: About $6.3 billion in virtual assets is stolen from Binance in an attack later described as a “complex attack” with several points of breach.
- 30 October 2026: Binance suspends withdrawals, says it is working to resolve the attack, and crypto prices fall sharply.
- 31 October 2026 (Saturday): The FBI attributes the theft to North Korea’s TraderTraitor group, publishes hundreds of flagged wallet addresses, and urges crypto businesses to block related transactions.
- 31 October 2026 (Saturday): Binance says it has replenished 90% of the stolen funds from company money, including its SAFU fund, and says withdrawals are on track to resume on Sunday.
- 1 November 2026 (Sunday): Binance’s planned resumption of withdrawals and its new proof-of-reserves snapshot come into focus as users check whether their assets are fully backed.
Background: the Binance theft itself
Binance is the world’s largest crypto exchange by daily trading volume. When news of the hack broke, it became the biggest crypto theft ever recorded, overtaking the $1.5 billion Bybit theft of February last year — an attack blamed on the very same TraderTraitor group now named by the FBI.
The earlier lhepen report on the theft itself covers how the breach unfolded: Binance lost about $6.3 billion in the biggest crypto theft on record. That report remains the best starting point for readers who want the full account of the attack before this attribution.
North Korea’s wider activity has also featured in recent lhepen coverage: Seoul said North Korea fired around 10 short-range missiles into the East Sea in late October, a reminder that the country’s weapons programmes and its cyber operations sit inside the same sanctions debate.
What happens next
Investigators will now watch whether the flagged addresses go quiet or scatter. If Chainalysis is right, the laundering network will widen in the coming weeks, spreading across bridges, instant exchanges and swappers that are harder to police than large, regulated exchanges.
Binance’s next test is practical: resuming withdrawals smoothly on Sunday and completing the final 10% of its token repurchases. If both happen without disruption, the exchange will have absorbed a record loss without passing it to users — a result that would strengthen its claim that its SAFU fund works as designed.
For regulators, the case is likely to sharpen an existing argument: that decentralised finance services and instant swap platforms need stronger controls on flagged funds, or they risk becoming the default laundering route for the largest thefts. Expect that debate to surface in the next round of US and international crypto enforcement statements.
FAQs
Who does the FBI blame for the Binance hack?
The FBI blames North Korea, specifically a hacking group it calls TraderTraitor, for stealing more than $6 billion in virtual assets from Binance on or about 29 October 2026.
How much was stolen from Binance?
About $6.3 billion, making it the biggest crypto exchange theft ever recorded — more than four times the $1.5 billion Bybit theft blamed on the same group last year.
What is happening to the stolen funds?
The FBI says TraderTraitor actors have been converting the stolen assets mainly into Ethereum and are expected to launder them further through decentralised finance and instant swap services. Stablecoin issuers had already frozen more than $2.4 billion before the FBI statement.
Has Binance covered its users’ losses?
Binance says it has replenished 90% of the stolen funds using company money, including its $1 billion SAFU fund, and will keep buying the remaining, less liquid tokens until coverage reaches 100%. It says it, not its users, will absorb the financial impact.
When will Binance withdrawals resume?
Binance said on Saturday that withdrawals, suspended after the hack, were on track to resume on Sunday, alongside a new proof-of-reserves snapshot verifying customer assets at a minimum 1:1 ratio.
Why does the FBI’s attribution matter?
It is the first official US confirmation of North Korea’s role, it comes with a published list of more than 600 flagged wallet addresses, and it asks the whole crypto industry to block transactions linked to the group — turning private suspicion into a coordinated enforcement effort.
Related coverage
Read the earlier lhepen report on the theft itself: Binance lost about $6.3 billion in the biggest crypto theft on record. For the wider North Korea context, see how North Korea fired around 10 short-range missiles into the East Sea in late October. More stories like this can be found in the Technology section.