The United States Federal Bureau of Investigation said on October 31, 2026, that North Korea was behind the theft of more than $6 billion in digital assets from Binance, the world’s largest cryptocurrency exchange, in what investigators and analysts describe as the largest crypto theft ever recorded. The announcement, issued as a cyber alert on Saturday, gave a name to an attack that had already shaken confidence across the digital asset industry: TraderTraitor, a North Korean cyber operation that American officials have linked to a long-running campaign against cryptocurrency platforms. The FBI said the theft took place on or about October 29, 2026, when billions of dollars in bitcoin and other digital currencies were moved out of Binance-controlled wallets within minutes. For ordinary users, the central question was never only who carried out the attack, but whether their money was safe. Binance said on the same day that it had replenished 90 percent of the stolen assets from its own funds and that customers would not bear the financial impact, while withdrawal services were expected to resume on November 1 after rigorous testing.
What the FBI says about the Binance hack and TraderTraitor
The FBI’s statement was short, but its implications were wide. It said the bureau, working with the United States Secret Service and the Internal Revenue Service’s Criminal Investigation division, had identified TraderTraitor as the actor behind the Binance theft. It also said the attackers had mainly been converting the stolen assets into ether, the second-largest cryptocurrency by market value, and were expected to move the funds onward through decentralized finance platforms and instant-swap services. Those services allow users to exchange one digital asset for another quickly, often with limited identity checks, and investigators say they are a favoured route for concealing the origin of stolen money. The FBI therefore urged a broad section of the crypto industry to block transactions connected to the theft. Its appeal named THORNode operators, RPC node operators, instant exchanges, decentralized finance services, blockchain analytics firms and other virtual asset service providers, asking them to refuse transactions with, or derived from, addresses used by TraderTraitor actors to launder the assets. The bureau published a list of addresses said to hold, or to have held, funds from the hack, including more than 600 Ethereum addresses, just under 20 Bitcoin addresses and a single Solana address.
How the $6.3 billion Binance theft unfolded
Binance first disclosed the breach on October 30, a day after the assets were taken. According to the company’s updates and blockchain records cited by analysts, funds began leaving its hot wallets, which are connected to the internet so that customer withdrawals can be processed, in the early hours of October 30 in Gulf time. The total taken was estimated at about $6.3 billion to $6.4 billion, spread across ten blockchain networks. That scale is what makes the incident stand out even in an industry accustomed to large hacks. The previous record cited by analysts was the $1.5 billion taken from the Bybit exchange in February 2025, an attack that American officials also linked to TraderTraitor. The Binance figure is roughly four times larger. Stablecoin issuers froze more than $2.4 billion of the stolen funds, according to reports of the incident, but the attackers continued to move much of the remainder. The speed of the theft, and the fact that it struck the industry’s largest exchange, explains why the FBI’s attribution arrived within days rather than weeks: investigators, exchanges and analytics firms were already tracing the flows in public, in near real time, on the blockchain itself.
Why investigators point to North Korea
TraderTraitor is not a new name in American cyber investigations. United States officials have previously used the label for North Korean-linked operations that target cryptocurrency businesses, often through social engineering, malicious software disguised as job applications or software updates, and the compromise of employees with access to sensitive systems. The FBI has associated the activity with the broader Lazarus Group and with a subgroup known as APT38, both of which Washington has sanctioned and accused of stealing funds to support the North Korean state. Blockchain intelligence firm TRM Labs had already attributed the Binance theft to TraderTraitor before the FBI’s formal announcement, and other analytics firms said the pattern of movements bore the hallmarks of a North Korean operation. That independent pattern-matching matters, because attribution in cyberspace is rarely based on a single piece of evidence. Investigators typically combine technical indicators, such as wallet addresses and malware signatures, with behavioural clues, such as laundering routes and timing, and with intelligence that is not made public. In this case, the FBI did not publish its full evidence in the alert. Its statement should therefore be read precisely for what it is: an official American attribution, supported by private-sector analysis pointing in the same direction, rather than a court-tested finding. North Korea has in the past denied involvement in cyber thefts attributed to it by Washington, and any response from Pyongyang to this specific attribution had not been reported in the coverage reviewed for this article.
The race to launder billions before they can be frozen
Once stolen cryptocurrency leaves an exchange, a race begins between the thieves and everyone trying to stop them. The thieves want to break the visible trail, convert the assets into forms that are harder to freeze, and eventually turn them into usable money. Investigators and exchanges want to identify the wallets, persuade stablecoin issuers and platforms to freeze what they can, and block further movement. Chainalysis, a blockchain analytics firm, said the Binance attackers had already used thousands of addresses and were using what its chief executive, Jonathan Levin, described as novel automated laundering mechanisms. The firm said it expected the number of addresses involved to grow into the tens of thousands in the coming weeks, as the stolen money is circulated between addresses and pushed through bridges, instant exchanges and swap services. That forecast helps explain the FBI’s unusual step of publishing hundreds of addresses at once: the list is a starting point, not a complete map, and it will grow. It also explains why the bureau’s warning was addressed not only to large exchanges but to the smaller infrastructure providers that sit between users and the blockchain. If any link in that chain refuses a transaction, the laundering process slows. If enough links refuse, some of the money may become effectively stranded, even if it is never formally seized.
Binance says users will not bear the loss
Binance’s response has been built around a single reassurance, repeated by co-chief executive Richard Teng: users will not bear the financial impact of the incident. On October 31, the exchange said it had replenished 90 percent of the stolen assets, up from 80 percent in an earlier update, and had set aside about $6.34 billion in company funds to cover the losses. The money is coming from three sources: a partial deployment of its Secure Asset Fund for Users, known as SAFU, a portion of its Futures insurance fund, and the company’s own corporate treasury. SAFU, created in July 2018, is an emergency reserve funded by the exchange to protect users in extreme situations, including security breaches. Binance said it would restore SAFU to about $1 billion after the incident. The remaining 10 percent of the stolen assets consists of less liquid tokens, which take longer to buy in the required amounts, the company said. Reserves in ten major cryptocurrencies, including bitcoin, ether and BNB, have been fully replenished, according to Binance, and a fresh proof-of-reserves snapshot was taken on October 31 so that users holding those assets can verify that their holdings are backed at least one-to-one once the full proof is published. Withdrawals, paused after the hack, were expected to resume on November 1, subject to final testing.
What this means for ordinary crypto holders
For people who hold cryptocurrency on an exchange, the Binance hack is a reminder of a distinction that is easy to forget when markets are calm. Assets held on a centralized exchange are, in practical terms, entries in that company’s systems, protected by its security and its balance sheet, rather than assets held directly by the user on the blockchain. That arrangement is convenient, because it allows instant trading and easy withdrawals, but it concentrates risk: a single breach can affect millions of accounts at once. Binance’s ability to cover a $6.3 billion loss from its own funds is exceptional, and it reflects the scale of the world’s largest exchange. Smaller platforms hit by far smaller thefts have in the past frozen withdrawals indefinitely, entered bankruptcy, or left users with only partial recoveries. The incident is therefore likely to renew two debates. The first is about proof of reserves and transparency: whether exchanges should publish regular, independently verifiable evidence that customer assets are fully backed. The second is about self-custody, the practice of holding digital assets in a wallet controlled directly by the owner rather than by an exchange. Neither option is risk-free. Self-custody removes exchange risk but puts the full burden of security on the individual, and a lost password or a phishing attack can be just as final as a hack. What the Binance case does show is that, for users of a large and well-capitalized exchange, the company’s reserves and insurance arrangements can matter as much as its trading fees or its range of tokens.
The wider pattern of state-linked crypto theft
American officials have for years accused North Korea of using cryptocurrency theft as a source of revenue, including to fund its weapons programmes in defiance of international sanctions. The sums involved have grown sharply. The FBI has previously linked TraderTraitor-affiliated actors to thefts from Alphapo, CoinsPaid and Atomic Wallet in 2023, and the $1.5 billion Bybit theft in 2025 was, until this week, the largest single crypto heist on record. The Binance theft extends that pattern to a new scale, and it raises an uncomfortable question for the crypto industry: how can a system designed to be open and borderless defend itself against an adversary that is itself a state, with the resources, patience and motivation to mount sustained campaigns? One answer offered by investigators is collective defence of the kind the FBI called for on Saturday, in which exchanges, analytics firms and infrastructure providers share addresses and block tainted funds quickly. Another is stronger regulation, including requirements for exchanges to hold segregated customer funds, maintain insurance, and submit to security audits. A third is technical: better wallet security, stricter controls on hot wallets, and limits on how much can be moved in a single transaction without additional approval. None of these measures alone would have prevented an attack of this sophistication, but together they could raise the cost and slow the payoff for the attackers.
Political reaction and what happens next
President Donald Trump, asked about the hack on Saturday, said his administration was learning about it and would talk to North Korea about it, according to reports of the exchange with reporters. That brief comment points to the diplomatic dimension of the attribution. The United States is already engaged in a tense standoff with North Korea over its weapons programmes, and a formal accusation of a record-breaking theft adds a further grievance to that relationship, even as Washington has in other contexts sought dialogue with Pyongyang. For investigators, the immediate work is less diplomatic than technical: tracing the remaining funds, updating the list of blocked addresses, and working with stablecoin issuers and exchanges in other jurisdictions to freeze what can still be frozen. For Binance, the immediate work is operational: completing the final 10 percent of replenishment, restoring withdrawals smoothly, publishing its proof of reserves, and rebuilding SAFU. For the wider industry, the test will be whether the blocking appeal is followed in practice, especially by smaller services that may not have compliance teams or may operate in jurisdictions with weaker enforcement. The history of previous large thefts suggests that some funds will be recovered or frozen, some will be successfully laundered over months or years, and some will remain visible on the blockchain, untouched, because moving them would expose the holders. The Binance theft, because of its size, will be watched as a measure of whether that collective defence can work at scale.
Sources
USN reviewed reporting from multiple outlets for this story. Read more from CoinDesk, LA NACION and Korea Times.