FBI officially names North Korea behind the Binance hack

What the FBI said. In a statement dated October 31, the bureau says North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29. The FBI calls this specific activity TraderTraitor. Reuters reports this is the first formal attribution of the hack to Pyongyang. Earlier, analysts at TRM Labs and Chainalysis had pointed to TraderTraitor with high confidence.

Where the money goes. The FBI, the US Secret Service and the IRS criminal investigation division see the stolen assets being converted mostly into ether. The bureau expects the money to move next through DeFi and instant swap services. So the FBI is asking THORChain node operators, RPC providers, instant exchanges, DeFi services and blockchain analytics firms to block transactions with these addresses or derived from them. The list is in the statement itself: hundreds of Ethereum addresses, 19 Bitcoin addresses and one Solana address.

What about Binance. According to Reuters, the exchange has replaced 90% of the stolen funds by buying tokens with its own money and set aside about $6.34 billion to cover the losses. Co-CEO Richard Teng called it a complex attack involving a compromised laptop and malware designed to delete evidence. Withdrawals were closed after the hack; on Saturday the exchange said it was on track to reopen them on Sunday.

Context. Investing.com notes that TraderTraitor was previously linked to the $1.5 billion theft from the Bybit exchange in 2025. If stolen funds can be frozen on other platforms, part of the losses may come back. This is our view, the FBI says nothing about recovering funds.

已确认的事实

• On October 31 the FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29.^[1][2]
• The FBI calls this activity TraderTraitor.^[1][2]
• The FBI, the US Secret Service and IRS-CI see the stolen assets being converted mostly into ether (ETH) and expect laundering through DeFi and instant swap services.^[1][2]
• The FBI published Ethereum, Bitcoin and Solana addresses and asks platforms to block transactions linked to them.^[1]
• Binance has replaced 90% of the stolen assets and set aside about $6.34 billion to cover losses, Reuters reports.^[2]
• Richard Teng described a complex attack with a compromised laptop and malware that deleted evidence.^[2]
• TraderTraitor was previously linked to the $1.5 billion theft from Bybit in 2025.^[3]

影响

• 已确认The North Korea link is now the FBI's official position, not only an analysts' estimate.
• 已确认Platforms that receive funds from the listed addresses will be under pressure to freeze them.
• 我们的解读If your wallet received a transfer from a listed address, an exchange may hold those funds. This is our view.

仍未知

• How much of the stolen money has already been frozen
• Whether Binance reopened withdrawals on time
• Whether the US will add new sanctions on North Korea over the hack

影响到谁

World, USA, North Korea. Binance users and anyone who keeps crypto on exchanges

来源

1. FBI: North Korea Responsible for $6 Billion+ Binance Attack 2026年10月31日 · 官方
2. Reuters (via NBC News): FBI says North Korea was behind the $6.3 billion Binance crypto hack 2026年10月31日 · 媒体
3. Investing.com: FBI links record $6.3 billion Binance crypto theft to North Korea 2026年11月1日 · 媒体