EL7.AI
CryptoMediumUpdated×4•Originally published 1 November 2026•Updated 1 November 2026•
4 min read

FBI Attributes More Than $6 Billion Binance Theft to North Korea

Key Facts

1The FBI said North Korea was responsible for stealing more than $6 billion from Binance.
2TRM estimated transfers of about $6.36 billion across ten networks.
3Binance said the loss of token assets amounted to about $6.3 billion, and that about $3 billion had been frozen by its October 30 update.
4Binance said on November 1 that it had covered about 95% of the affected amount, up from 90% in the previous update.
5Binance said it was targeting the resumption of the first phase of withdrawals on November 1 between 06:00 and 09:00 UTC.

The U.S. Federal Bureau of Investigation said on October 31 that North Korea was responsible for stealing more than $6 billion in virtual assets from Binance, naming the activity “TraderTraitor.” The government attribution followed the October 29 breach of the platform’s hot wallets, in one of the largest recorded thefts in the cryptocurrency sector. TRM Labs estimated that about $6.36 billion was transferred from Binance wallets to addresses controlled by the attacker, calculated using the value of the assets when they were stolen. Binance, meanwhile, said the loss of token assets amounted to about $6.3 billion, a separate estimate from the total transfers tracked by TRM. The FBI announcement framed the incident as an operation attributed to North Korea, while The Associated Press quoted President Donald Trump as saying they did not yet know whether Pyongyang was behind the breach.

According to Binance, the breach occurred at about 20:05 UTC on October 29, when its hot wallets were compromised. The platform said its initial investigation indicated the possible involvement of a DevOps engineer’s compromised laptop, which allowed the attacker to access a service container and send unauthorized withdrawal transactions. Binance said it had found no evidence that the wallets’ private keys had been exposed, but described the compromised computer as a preliminary finding of its investigation. TRM estimated that most of the funds moved within about 20 minutes of the breach. The company compared the scale of the incident with the $1.5 billion Bybit breach in February 2025, saying the Binance incident was about four times as large.

TRM’s estimates of transfers by network showed that Ethereum accounted for about $3.79 billion, compared with about $1.47 billion on Bitcoin. The company estimated transfers on Tron at about $628 million, on XRP Ledger at about $296 million, and on Solana at about $96 million. The FBI said the stolen assets had moved primarily to Ethereum and expected the attackers to turn later to decentralized finance and instant-swap services to convert them. The FBI, the Secret Service and the Internal Revenue Service asked node operators and digital-asset services to block transactions linked to addresses used by the activity called “TraderTraitor.” The move connects the government warning with the transfer routes tracked by TRM, as the transfers involved multiple assets and networks.

Binance said in an October 30 update that its partners had frozen about $3 billion on-chain by that date. In the same update, the platform said it had allocated more than $6.34 billion in company funds to cover the impact, including $5 billion in the affected token assets themselves, equivalent to about 80% of the affected value by its estimate at the time. On October 31, Binance said it had restored coverage for 90% of the stolen assets, and that customer balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were fully backed. These figures reflect successive updates from the platform, with each differing in scope and timing between funds frozen and coverage reported. Binance said it was using company resources and the SAFU fund in its efforts to cover the affected assets.

In its November 1 update, Binance said it had raised coverage of the affected amount to about 95%, from 90% in its previous update. The platform attributed the remaining amount to less-liquid tokens that were difficult to source quickly in the required quantities, and said it was buying them through public markets and over-the-counter trading. It also pledged to restore the SAFU fund to about $1 billion after using part of it to finance asset coverage. Binance said it was targeting the start of a phased resumption of withdrawals on November 1, with the first phase scheduled between 06:00 and 09:00 UTC. The update did not say withdrawals would resume all at once, instead linking the return to the first phase and the continuation of the announced arrangements.

TRM estimates indicate that preparations for the attack began at least 36 hours before the theft, as the operator’s wallet received three small withdrawals from Tornado Cash starting on the morning of October 28. TRM analyst Ari Redbord told The Associated Press that the attackers could split the assets and try to launder them through smaller platforms, a process that could take months. This possibility comes as the FBI expects the use of decentralized finance and instant-swap services in later stages, and has called on service operators to block dealings with specified addresses. Trump, meanwhile, told the news agency that North Korea’s responsibility might become clear later, after saying the matter had not yet been settled for them. The next announced step on the platform’s side is the gradual resumption of withdrawals, while Binance said it was continuing to cover the remaining share of the affected assets.