EN
Español
Português (Brasil)
Türkçe
Tiếng Việt
Bahasa Indonesia
Polski
Čeština
Română
Slovenčina
Magyar31 Oct 2026
The FBI has formally attributed the record Binance hack to North Korea, naming the TraderTraitor group behind the theft of more than $6 billion in crypto. The bureau says stolen funds are mostly being converted to ETH and published wallet addresses it wants the industry to block.
Exchanges TradeReviewed News Desk
The Binance hack now has an official culprit. In a cyber alert dated October 31, 2026, the FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29. The bureau refers to this North Korean activity as “TraderTraitor”.
That moves the attribution from private analysts to the US government. On Thursday the FBI only said it was engaged with partners and did not attribute the intrusion, while TRM Labs and Chainalysis had already pointed at TraderTraitor with high confidence.
What the FBI said
- The FBI, together with the US Secret Service and IRS Criminal Investigation, has seen TraderTraitor converting stolen assets primarily into Ethereum (ETH).
- It expects those funds to be laundered further through DeFi and instant swap services.
- The agencies are urging THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other crypto service providers to block transactions with, or derived from, the laundering addresses.
- The alert lists hundreds of Ethereum addresses plus Bitcoin and Solana addresses that hold or have held stolen assets.
Why the attribution matters
A formal FBI attribution is the same step the bureau took after the $1.5 billion Bybit theft in February 2025. It gives exchanges, bridges and node operators a public, government-backed list to screen against, which raises the cost of moving the remaining funds. The call-out to THORNode operators is notable: THORChain, a route North Korean launderers used after Bybit, already paused most swaps on Saturday after an Ethereum reorg. For how the stolen funds have moved so far, see our coverage of the laundering trail.
Chainalysis says the theft totalled about $6.4 billion, the largest in crypto history, and that roughly $2.8 billion had been frozen at the time of its update. Binance says it has replenished 90% of the stolen assets and plans to reopen withdrawals on November 1; see our breakdown of the Binance recovery update.
What it means for traders
- No new loss, new pressure on the thief. The attribution does not change Binance’s balance sheet, but blocklists can slow how fast stolen ETH reaches the market.
- Watch ETH flows. With the FBI saying the stolen funds sit mostly in ETH, large moves from flagged wallets toward DeFi or swap services are the flows to track.
- Market so far calm. Bitcoin traded near $77,500 on OKX at publication, up less than 1% on the day.
Want to spread exchange risk? Compare platforms in our exchange comparison, with BingX ranked first and OKX second, or read where to buy your first bitcoin.
This article is for information only and is not financial advice.
Follow TradeReviewed on X and our Telegram channel: you hear crypto and trading news here first.
Related reviews
Sources
- FBI: North Korea Responsible for $6 Billion+ Binance Attack
- Chainalysis: The $6.4 Billion Binance Hack: Tracing the North Korea Link
- Nextgov/FCW: FBI is involved in response to $6.3 billion Binance hack linked to North Korea
News is for information only and is not financial advice. More crypto news
You'll hear it here first
Get crypto news first on our Telegram channel.