FBI attributes $6B+ Binance hack to North Korea’s TraderTraitor

The attribution question in the Binance theft has moved beyond private-sector analysis. On October 31, 2026, the FBI formally stated that North Korea was responsible for stealing more than $6 billion in virtual assets from Binance and identified the operation as TraderTraitor. The bureau also published linked addresses and asked crypto infrastructure providers to help disrupt the laundering chain.

From assessment to official attribution

Blockchain intelligence firms had already linked the theft to North Korea with high confidence. That was an intelligence assessment, not a government finding. The distinction changed on October 31 when the FBI issued a cyber alert saying the Democratic People’s Republic of Korea was responsible for the theft of more than $6 billion from Binance on or about October 29.

The alert uses the name TraderTraitor for this specific North Korean cyber activity. It is the clearest official attribution to date. The public notice does not, however, disclose the full intelligence case or provide a complete technical root-cause analysis of Binance’s internal compromise.

For the evidence available before the FBI announcement, see SIAMBC’s earlier TraderTraitor investigation update.

Who is TraderTraitor?

TraderTraitor is a US government label for North Korean cyber activity targeting blockchain companies and high-value crypto holders. Reporting may discuss the activity alongside Lazarus Group, APT38, BlueNoroff and Stardust Chollima, but those names do not always describe identical organisational boundaries.

A joint FBI, CISA and US Treasury advisory describes a playbook built around social engineering, false job approaches and trojanised crypto applications. Targets have included exchanges, DeFi protocols, blockchain gaming companies, investment firms and individuals holding valuable digital assets.

The Binance incident therefore sits within a longer campaign rather than appearing as an isolated theft. The FBI used the TraderTraitor designation when it attributed the 2025 Bybit theft to North Korean actors as well.

How investigators expect the funds to move

The FBI says it is working with the US Secret Service and IRS Criminal Investigation and has observed the actors converting stolen assets primarily into ETH. Investigators expect the ETH to move through DeFi and instant-swap services as the operators prepare it for additional laundering stages.

Consolidating into ETH can provide access to a broad range of decentralised exchanges, bridges and liquidity venues. It does not erase blockchain history, but it can fragment the trail across more assets, contracts and networks, increasing the operational burden on investigators and compliance teams.

This does not mean Ethereum itself was hacked. Available reporting points to Binance hot wallets and withdrawal infrastructure. ETH is being used as a liquid routing asset after the theft.

Why the FBI address list matters

The alert publishes a large set of addresses that have held stolen assets and are operated by, or closely connected to, TraderTraitor. Publishing machine-readable indicators allows private-sector monitoring systems to act without waiting for a later sanctions notice.

The FBI, USSS and IRS-CI specifically urge THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics companies and other virtual-asset service providers to block transactions from or derived from the listed addresses.

Publishing an address does not automatically freeze native BTC or ETH. Those assets have no central issuer with a blacklist switch. Exchanges and service providers can still reject deposits, suspend accounts and preserve evidence. Centralised stablecoin issuers may also use contract-level controls to stop listed tokens from moving.

Binance recovery update

Binance estimates the incident at roughly $6.3 billion and says SAFU and corporate funds will absorb the loss rather than customers. The exchange has said the affected area was its hot-wallet and withdrawal infrastructure and that it has found no evidence of wallet private keys being leaked.

In its November 1 recovery update, Binance said it had replenished approximately 95% of affected assets and was restoring withdrawals in phases after security and readiness checks.

BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were reported as fully backed. The remaining 5% consisted of less-liquid tokens outside that group. Binance says a post-incident report will follow once its investigation is complete.

Replenishment should not be confused with recovery from the attackers. Binance can use SAFU and corporate assets to restore reserves while law enforcement, issuers and industry partners separately trace, freeze and seek to recover stolen funds.

Confirmed facts and open questions

Practical steps for users and businesses

For individual users

• Check withdrawal availability for the specific asset and network directly in Binance because services are returning in phases.
• Ignore compensation, wallet-verification and recovery links sent through unsolicited messages.
• Never provide a seed phrase, private key, OTP or backup code to support staff or recovery agents.
• Review account login history, authorised devices, API keys and withdrawal addresses.
• Use a passkey or hardware security key where supported, and separate long-term holdings from trading balances.

For exchanges, DeFi services and infrastructure providers

• Ingest the FBI indicators into transaction-monitoring and counterparty-screening systems.
• Watch for movement through bridges, DEXs, instant swaps and cross-chain services.
• Review endpoints, cloud privileges, signing systems, service containers and DevOps devices.
• Prepare evidence-preservation and law-enforcement escalation procedures before suspicious funds arrive.

FAQ

Has the FBI officially blamed North Korea?

Yes. The October 31 alert states that North Korea was responsible for stealing more than $6 billion in virtual assets from Binance and identifies the activity as TraderTraitor.

Did the FBI disclose all of its evidence?

No. The public alert gives the attribution, observed laundering behaviour and connected addresses, but not the full underlying intelligence case.

Are Binance withdrawals fully back to normal?

Binance began a phased restoration on November 1. Availability depends on the asset and network, so users should check the withdrawal or network-status page before transacting.

Does 95% replenishment mean 95% of the stolen money was recovered?

No. Replenishment uses Binance and SAFU resources to restore affected assets. Recovery from the attackers is a separate legal and technical process.

Would a hardware wallet prevent this type of loss?

A hardware wallet lets an individual hold private keys outside an exchange and reduces custodial exposure for long-term holdings. It does not remove the need to secure the recovery phrase, verify transactions and avoid phishing or malicious smart contracts.

References

• FBI cyber alert
• Binance Recovery Update #4
• Binance Security Incident Update #2
• TRM Labs analysis
• US government TraderTraitor advisory

Information current to November 2, 2026. The investigation, asset tracing and Binance service restoration remain active. Figures may change as verified updates are released. Educational information only; not financial or legal advice.