The Federal Bureau of Investigation has blamed North Korea’s TraderTraitor operation for the theft of more than $6 billion in virtual assets from the Binance cryptocurrency exchange, in a cyber alert issued on Saturday, October 31, 2026. The alert was issued jointly with the United States Secret Service and IRS Criminal Investigation, and it attributes the theft, which occurred on or about October 29, 2026, to the North Korean hacking operation.
According to the alert, the stolen assets are being converted primarily into Ethereum, and investigators expect further laundering through decentralised finance platforms and instant-swap services. The FBI published a list of wallet addresses linked to the theft and urged exchanges, decentralised finance services and blockchain analytics firms to block transactions from them.
What the FBI published
The address list contains more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address. The appeal to block those addresses is intended to make it harder for the stolen funds to be moved, converted or cashed out through legitimate platforms, even as investigators acknowledge that determined actors often try to route funds through services with weaker controls.
Why TraderTraitor matters
TraderTraitor is a name US investigators have previously used for North Korean activity involving social-engineering and fake job or recruitment approaches aimed at people working in cryptocurrency and technology. The FBI previously blamed the same operation for the roughly $1.5 billion Bybit hack in February 2025, which was at the time described as one of the largest cryptocurrency thefts on record. The Binance case, by value, is far larger.
The scale of the incident has been estimated in different ways, and those figures should not be added together. TRM Labs estimated the theft at $6.36 billion across 10 blockchains. That estimate describes the same incident as the FBI alert, not an additional loss on top of it. Binance has separately described losses of about $6.3 billion, a figure that is consistent with that scale of theft.
What Binance says, and what happens next
Binance has said it covered about 90% of the roughly $6.3 billion in losses, with withdrawals targeted to resume on Sunday, November 1. Further detail on that replenishment effort is set out in Emadan News coverage of Binance’s 90% replenishment and the planned resumption of withdrawals, and on Binance’s use of half of its SAFU fund to cover hack losses.
President Donald Trump, asked about the incident, said his administration was learning about it and would talk to North Korea about it. He said: “we’re learning about it” and that the administration would “talk to North Korea about it”. No further detail of any diplomatic approach was given in the reporting.
A caveat on attribution
An attribution of this kind is a law-enforcement assessment. It does not, on its own, mean that the stolen funds have been recovered, and it does not settle every technical question about how the intrusion took place. Recovery, if any, will depend on whether funds can be frozen before they are laundered, and on cooperation from exchanges and other services that encounter the flagged addresses.
For now, the practical message from the alert is aimed at the industry: check transactions against the published addresses, block them where possible, and report matches to investigators. The wider diplomatic and sanctions consequences, if any, remain to be seen.
Sources
- Bloomberg — FBI Blames North Korea for $6 Billion Binance Crypto Hack
- CoinDesk — FBI Confirms North Korea’s Role in $6 Billion Binance Hack
- Korea Times — FBI Says North Korea Responsible for Over $6 Billion Crypto Theft From Binance
