EL7.AI
CryptoMediumUpdated×2•Originally published 1 November 2026•Updated 1 November 2026•
4 min read

FBI Attributes More Than $6 Billion Binance Theft to North Korea

Key Facts

1The FBI said North Korea was responsible for stealing assets worth more than $6 billion from Binance at around October 29.
2TRM estimated transfers at about $6.36 billion across 10 networks, with most taking place over about 20 minutes.
3Binance said on October 31 that it had covered 90% of affected assets and was working to buy the remaining 10%.
4The FBI said the assets were moved mainly to Ethereum and expected decentralized finance and instant-swap services to be used in laundering them.

The U.S. Federal Bureau of Investigation said on October 31 that North Korea was responsible for stealing virtual assets worth more than $6 billion from Binance at around October 29, attributing the activity to the “TraderTraitor” group. TRM Labs estimated that about $6.36 billion was transferred out of the platform’s wallets at the time, while valuing the same assets at about $6.23 billion at later prices. The company said most transfers took place over about 20 minutes, starting at 20:05 UTC on October 29. The operation involved 10 blockchain networks, according to its analysis. The FBI’s announcement puts the estimate above $6 billion, while TRM’s analysis measures the transfers it tracked and their value at the time they occurred.

Ethereum accounted for the largest share of the transfers, at about $3.79 billion, followed by Bitcoin at about $1.47 billion, according to TRM. The company estimated transfers via Tron at about $628 million and via XRP Ledger at about $296 million, while transfers on Solana totaled about $96 million. It said the theft was nearly four times the $1.5 billion stolen in the Bybit platform hack in February 2025. TRM described the operation as the largest in the history of cryptocurrency thefts. The transfers showed assets moving across multiple networks, while the FBI and its investigative partners, the U.S. Secret Service and the Internal Revenue Service, said the stolen assets were moved mainly to Ethereum.

TRM said preparations for the attack began at least 36 hours before it took place. The company detected three small transfers from Tornado Cash to the operator’s wallet, starting on the morning of October 28. In its account of how the attack was carried out, it said the attacker used an EIP-7702 delegation on Ethereum to execute a withdrawal contract controlled by the attacker through a Binance hot wallet. It added that 50 approvals had been pre-signed before the operation. TRM said the signature pattern suggested a possible compromise of the hot-wallet signing infrastructure, while Binance said it had not published a confirmed root cause. In its initial account, the platform said the investigation had pointed to a possible compromise of a DevOps engineer’s laptop, which enabled access to a service container and the submission of unauthorized withdrawal transactions. It pledged to publish a technical review after the investigation was complete and the facts had been verified.

The FBI and its investigative partners expected decentralized finance and instant-swap services to be used in later stages of laundering the assets. The agencies urged virtual asset companies and services to block transactions linked to specified addresses in an effort to prevent money laundering and concealment of the funds’ origin. In its first update, published on October 30, Binance said the estimated total impact was about $6.3 billion. It added that partners had helped freeze about $3 billion on-chain by that time, and announced a temporary suspension of withdrawals. The platform said it had found no evidence that wallet private keys had been leaked. The Associated Press reported that Circle and Tether froze funds linked to the incident on Thursday, with more than $800 million for the former and more than $1.5 billion for the latter.

In an October 31 update, Binance said the share of affected assets it had covered had risen to 90%, compared with about 80% in its previous update. It added that it was working to buy the remaining 10% through the market and over-the-counter trading, noting that lower liquidity in those assets could prolong the purchase of the required amounts. It said it would bear the financial impact and was committed to restoring customers’ assets in full. It said the coverage drew on part of the SAFU fund, part of the futures insurance fund and the company treasury. It also pledged to restore the SAFU fund to about $1 billion, and Reuters reported that Binance had internally allocated about $6.34 billion to cover losses.

Binance said it was targeting a reopening of withdrawals on Sunday, November 1, and would issue an update once details were confirmed. The platform took a new snapshot of reserves at 00:00 UTC on October 31, according to its statement. It estimated that preparing the full proof of reserves would take 40 to 50 hours after the snapshot, and expected it to be available by Tuesday, November 3. In a broader context, the U.S. Treasury Department said in November 2025 that North Korea-linked actors had stolen more than $3 billion, mostly in cryptocurrency, over the previous three years. The Associated Press had reported that Bitcoin’s price fell 3.2% to below $79,000 on Thursday evening, October 29. The news agency noted that the decline came on the day of the theft, as Binance continued to announce coverage of the affected assets and its plan to resume withdrawals.