FBI officially names North Korea behind the Binance hack
The FBI says North Korea is behind the theft of more than $6 billion from Binance and has published the addresses used to launder the money.
Event: October 31, 2026
Primary source: October 31, 2026
Published here: November 1, 2026 at 01:10 AM UTC
Read: 2 min
What happened
On October 31 the FBI said North Korea was responsible for the theft of more than $6 billion in crypto from the Binance exchange. The bureau calls this activity TraderTraitor. Before this only analytics firms pointed to North Korea, now it is the official US position.
Why it matters to you
The FBI, the Secret Service and the IRS criminal investigation unit see the stolen funds being converted mostly into ether (ETH). The bureau expects further laundering through DeFi and instant swap services. The FBI published a list of ETH, BTC and SOL addresses and asks platforms to block transactions linked to them.
What to check and watch
Binance says it has already covered 90% of the stolen assets and planned to reopen withdrawals on November 1. Watch how much money gets frozen using the FBI list.
Where it’s happening
LIVEDrag to spin. Green dots: the exchange is trading right now (regular hours, holidays not counted). Shadow: where it is night now. Borders: Natural Earth, quakes: USGS. Layer idea: God’s Eye View (MIT).
What the FBI said. In a statement dated October 31, the bureau says North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29. The FBI calls this specific activity TraderTraitor. Reuters reports this is the first formal attribution of the hack to Pyongyang. Earlier, analysts at TRM Labs and Chainalysis had pointed to TraderTraitor with high confidence.
Where the money goes. The FBI, the US Secret Service and the IRS criminal investigation division see the stolen assets being converted mostly into ether. The bureau expects the money to move next through DeFi and instant swap services. So the FBI is asking THORChain node operators, RPC providers, instant exchanges, DeFi services and blockchain analytics firms to block transactions with these addresses or derived from them. The list is in the statement itself: hundreds of Ethereum addresses, 19 Bitcoin addresses and one Solana address.
What about Binance. According to Reuters, the exchange has replaced 90% of the stolen funds by buying tokens with its own money and set aside about $6.34 billion to cover the losses. Co-CEO Richard Teng called it a complex attack involving a compromised laptop and malware designed to delete evidence. Withdrawals were closed after the hack; on Saturday the exchange said it was on track to reopen them on Sunday.
Context. Investing.com notes that TraderTraitor was previously linked to the $1.5 billion theft from the Bybit exchange in 2025. If stolen funds can be frozen on other platforms, part of the losses may come back. This is our view, the FBI says nothing about recovering funds.
Confirmed facts
- On October 31 the FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29.[1][2]
- The FBI calls this activity TraderTraitor.[1][2]
- The FBI, the US Secret Service and IRS-CI see the stolen assets being converted mostly into ether (ETH) and expect laundering through DeFi and instant swap services.[1][2]
- The FBI published Ethereum, Bitcoin and Solana addresses and asks platforms to block transactions linked to them.[1]
- Binance has replaced 90% of the stolen assets and set aside about $6.34 billion to cover losses, Reuters reports.[2]
- Richard Teng described a complex attack with a compromised laptop and malware that deleted evidence.[2]
- TraderTraitor was previously linked to the $1.5 billion theft from Bybit in 2025.[3]
Implications
- ConfirmedThe North Korea link is now the FBI's official position, not only an analysts' estimate.
- ConfirmedPlatforms that receive funds from the listed addresses will be under pressure to freeze them.
- Our readingIf your wallet received a transfer from a listed address, an exchange may hold those funds. This is our view.
Still unknown
- How much of the stolen money has already been frozen
- Whether Binance reopened withdrawals on time
- Whether the US will add new sanctions on North Korea over the hack
Who it affects
World, USA, North Korea. Binance users and anyone who keeps crypto on exchanges
Sources
- FBI: North Korea Responsible for $6 Billion+ Binance Attack October 31, 2026 · official
- Reuters (via NBC News): FBI says North Korea was behind the $6.3 billion Binance crypto hack October 31, 2026 · media
- Investing.com: FBI links record $6.3 billion Binance crypto theft to North Korea November 1, 2026 · media
Cover: Freekonomist graphic, a symbolic image, not a photo of the event. This is a news explainer, not financial advice.
More stories
South Korea exports nearly double in October as chip sales jump 259%
South Korea sold 93.7% more abroad in October than a year ago, and chips for AI were again the main engine.
Tom Lee says dip buyers are waiting for the November 3 midterms
Tom Lee of Fundstrat says big investors are not buying the Nasdaq dip because they are waiting for the US midterm elections on November 3. This is his opinion, not a fact.
Savings accounts after rate hikes: why many savers miss the bonus rate
Savings accounts: after the Reserve Bank of Australia's September hike, the four biggest banks raised top rates by 0.20 or 0.25 points, but the base rate stayed at 0.10%.
Morning brief by email
The night's key moves and what matters today, in 2 minutes. One-click unsubscribe.