FBI ties $6bn-plus Binance theft to North Korea

The FBI has attributed the theft of more than $6 billion in digital assets from Binance to North Korean hackers, putting the focus on tracing funds and preventing their laundering. In its report on the FBI’s attribution, the Associated Press said the bureau identified the activity as TraderTraitor. Binance has said it will cover customers’ losses.

The attribution gives exchanges and blockchain services a specific group and set of addresses to watch as stolen assets move.

What did the FBI say about the Binance theft?

The FBI said the theft took place on or about October 29, 2026, and involved more than $6 billion in virtual assets. It named the North Korean activity “TraderTraitor” and said investigators had observed the actors converting stolen assets primarily into Ether. The bureau urged crypto exchanges and other service providers to block transactions linked to addresses associated with the theft.

According to the ABC News report on Binance’s breach and response, the exchange estimated its total financial impact at about $6.3 billion. Binance said it had worked with blockchain partners to freeze about $3 billion in affected assets on-chain, and that it had covered 90% of the impacted amount by Saturday, October 31. Those are separate measures: funds frozen by partners are not necessarily funds recovered, while Binance’s stated coverage is its own commitment to absorb losses.

How could the stolen assets be laundered?

The FBI expects TraderTraitor to move the assets through decentralized finance services and instant swap services as part of further laundering. These services can exchange or route crypto assets, so the bureau’s request to block associated transactions aims to disrupt that movement. Its public alert included addresses that it said were holding, or had held, assets from the theft.

Blockchain tracing can make transfers visible, but visibility does not guarantee that funds can be stopped or returned. The FBI’s request depends on exchanges, node operators, DeFi services and other firms identifying and blocking transactions connected to the listed addresses. The bureau did not say how much of the stolen crypto it had recovered.

What remains uncertain about the attack?

The FBI’s public statement assigns responsibility to North Korea, but the full technical account of how the breach happened remains open. ABC News reported that Binance’s initial investigation suggested an attacker may have gained access through a DevOps engineer’s compromised laptop; Binance also said it found additional breach points and was still gathering facts. The exchange said it planned to publish a technical post-mortem after its investigation was complete.

The scale of the theft and the attribution are clear in the FBI’s account, but the mechanism and recovery outcome are not yet fully established. Binance’s promise to cover losses addresses customer exposure as the investigation continues, while the funds’ movement remains a live enforcement challenge.

References

• report on the FBI’s attribution — apnews.com
• ABC News report on Binance’s breach and response — abcnews.com