FBI Attributes More Than $6 Billion Binance Theft to North Korea
Key Facts
The U.S. Federal Bureau of Investigation blamed North Korea for the theft of virtual assets worth more than $6 billion from Binance in an attack on October 29, 2026. The bureau named the activity TraderTraitor, according to its statement published on October 31. TRM had attributed the attack to North Korea’s TraderTraitor unit with high confidence, based on on-chain and off-chain information. The company said its initial analysis was based on on-chain activity observed through October 30 at 00:30 UTC, while the transfers date to October 29. TRM estimated that the theft accounted for a large share of the increase in cryptocurrency thefts linked to North Korea during 2026.
The FBI said it traced the stolen assets, working with the Secret Service and the Internal Revenue Service, as they were converted mainly into Ethereum. TRM estimated outflows on the Ethereum network at about $3.79 billion, comprising 200,630 ETH and 185 other tokens. Those tokens included 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD. The bureau said decentralized finance and instant-swap services could be used in later stages of money laundering. That path puts transfers between networks and tokens at the center of efforts to trace funds that left the platform.
TRM’s analysis described the attack mechanism on Ethereum as an EIP-7702 delegation that turned a Binance hot wallet into an aggregation tool controlled by the attacker. The company said the attacker prepared 50 pre-signed delegations before carrying out the operation. TRM said the mechanism pointed to a compromise of the infrastructure used to sign hot-wallet transactions. In its initial investigation, Binance said a laptop belonging to an engineer on the operations and development team may have enabled access to a services container and the execution of unauthorized withdrawals. The company added that it had found no evidence that wallet private keys were leaked.
On the fund-tracking front, TRM said stablecoin issuers froze about $2.67 billion of these assets. It added that Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB on its network, bringing total frozen assets to about $2.7 billion. In a separate report, the Associated Press quoted Binance as saying it had allocated more than $6.34 billion in company funds to cover the stolen assets and had worked with blockchain network partners to freeze about $3 billion in affected assets. Binance said user funds were safe and that it would cover the full amount stolen. The differing figures reflect estimates from different sources and at separate points in time.
Binance said in an update on November 1 that it had secured the purchase of about 95% of the affected assets, up from 90% in its previous update. It said the remaining 5% consists of less liquid tokens outside the list of its 10 largest tokens. It added that it continued to buy the remaining assets through the market and over-the-counter trading channels. The platform began the first phase of resuming withdrawals on November 1, between 14:00 and 17:00 UTC+8, while deposits continued as normal. It said withdrawals would resume gradually after stability and security checks, and that the order of assets and networks would be based on user-demand data from the previous week.
On the market impact, Reuters reported that spot Bitcoin exchange-traded funds recorded outflows of $643 million on Friday, October 30, the largest daily outflows in October. The agency quoted TRM as saying that liquidations of leveraged positions exceeded $1.3 billion. Ari Redbord, TRM’s head of policy, said, "A cryptocurrency platform hack is like a bank robbery at internet speed." He added that the attack "creates an unstable risk profile for anyone managing other people’s money." EL7 data showed Bitcoin closing at $78,000.01 on November 2, compared with $80,150.56 on October 26.
Binance, according to Reuters, said it had more than 335 million users worldwide and average daily trading volume of $95 billion in digital assets and derivatives. The incident took place on a platform with a large user base and trading volume, while the company said the investigation was ongoing. Binance pledged to publish an incident review report after the investigation is complete. More broadly, TRM said cryptocurrency thefts attributed to North Korea-linked actors totaled about $12.8 billion across 100 incidents from 2017 through October 29, 2026. The company estimated that $7.4 billion of that total was stolen during 2026.