FBI blames North Korea's TraderTraitor for Binance theft

The Federal Bureau of Investigation said on 31 October 2026 that the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion in virtual assets from the cryptocurrency exchange Binance on or about 29 October. The FBI calls this North Korean activity "TraderTraitor" (FBI alert, 31 October 2026).

What the FBI said

• Laundering: with the US Secret Service (USSS) and IRS Criminal Investigation (IRS-CI), the FBI has seen the attackers convert stolen assets mainly into Ether (ETH). It expects them to launder the funds further through DeFi and instant swap services.
• Request to the industry: the agencies urge THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions with, or derived from, the addresses the attackers use.
• Addresses: the alert lists 628 addresses holding or having held assets from the theft: 608 on Ethereum, 19 on Bitcoin and 1 on Solana.

Other accounts

Binance's incident report of 3 November says the FBI's latest information indicates North Korea is responsible, and that Binance's security team detected and prevented 57 suspected North Korea-linked cases during 2026 (Binance incident report). Chainalysis says laundering patterns it saw early on pointed to TraderTraitor (Chainalysis).

The first account of the theft is Binance says $6.3 billion was stolen from its hot wallets. Where the funds went, and how much was frozen, is in Chainalysis: $2.8 billion of the Binance theft is frozen.