FBI attributes $6 billion Binance theft to North Korean group TraderTraitor

The FBI has formally attributed the theft of more than $6 billion in virtual assets from the Binance exchange to North Korea. The bureau’s alert, published Saturday, October 31, says the theft happened on or about October 29, 2026, and names the actor as “TraderTraitor.” ¹

That is a step beyond what analysts offered in the first days after the heist. Blockchain intelligence firms TRM Labs and Chainalysis had already linked the attack to the same group, and the FBI statement now puts a government name on it. ² The group is also tracked as Lazarus Group, Jade Sleet and APT38. ²

The FBI worked with the U.S. Secret Service and IRS Criminal Investigation. Those agencies have watched the attackers convert stolen assets mostly into Ether, and they expect the funds to move on through DeFi platforms and instant swap services. ¹ That is the standard laundering route: hop between assets and services until the trail gets hard to follow. ³

The request to industry is concrete. THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset providers are asked to block transactions involving the attackers’ addresses. ¹ The FBI published the list, which one outlet counts at 628 addresses: 608 Ethereum, 19 Bitcoin and one Solana. ² Anyone with information is pointed to a local FBI field office or ic3.gov. ¹

On how the attackers got in, Binance has said a DevOps engineer’s laptop was compromised. That gave the attackers access to a service container, from which they submitted unauthorized withdrawals. ² Most of the roughly $6.36 billion, spread across ten blockchains, moved in about 20 minutes. ² The sources give the total as $6.3 billion to $6.7 billion, depending on the outlet. The FBI itself says only “more than $6 billion,” and that is the figure to hold onto.

Binance says it is preparing to resume the first phase of withdrawals on November 1 between 06:00 and 09:00 UTC. It reports covering about 95% of the impacted amount, up from 90%, with the remainder in less-liquid tokens it is still buying. It also says the losses will not be passed on to users. ² Those are the company’s own statements.

Seen it before: a compromised employee machine is the way in, and the money is gone before anyone reads the alert. The same pattern shows up in earlier North Korea-linked thefts such as Bybit and DMM Bitcoin, where attackers reached systems through developers’ or employees’ computers. ²

What you should do: if you hold funds on an exchange, watch for messages claiming to help recover them. One UK Finance director told Newsweek she expects a wave of fraudsters contacting potential victims. ³ Your own device security still matters, and changing passwords is cheap.

Our read: The attribution matters less as a verdict than as a filter. The published address list gives exchanges and swap services something specific to block, and that is where the laundering fight will be won or lost. What remains open is how much of the stolen money can be frozen before it is swapped through.

Footnotes

1. TechRadar, “FBI confirms it thinks North Korean hackers hit Binance in record cryptocurrency heist”. Retrieved November 2, 2026. ↩ ↩² ↩³ ↩⁴

2. FBI, “North Korea Responsible for $6 Billion+ Binance Attack”. Retrieved November 2, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

3. Newsweek, “FBI Says North Korea Behind $6 Billion Binance Crypto Theft”. Retrieved November 2, 2026. ↩ ↩²