FBI blames North Korea's TraderTraitor for $6 billion Binance hack

The FBI has blamed North Korea for stealing more than $6 billion from Binance, naming a state hacking unit it calls TraderTraitor in an alert dated October 31. The agency also published 628 crypto wallets it tied to the theft.

Investigators posted the alert on the FBI's website on Saturday. It said the money left Binance on or about October 29. Blockchain intelligence firms TRM Labs and Chainalysis had pointed to the same North Korean group within hours of the breach, so the government only confirmed what on-chain analysts already suspected.

What the FBI said

In the alert, the FBI wrote that it "refers to this specific North Korean malicious cyber activity as 'TraderTraitor.'" The Cybersecurity and Infrastructure Security Agency describes TraderTraitor as a state-sponsored group that has stolen crypto since at least 2020. Security researchers link it to the wider Lazarus Group.

An official attribution changes what others can do. Private firms had already named TraderTraitor, but a US government finding gives exchanges firmer legal ground to freeze funds. It also feeds the sanctions Washington aims at North Korea's weapons programs, which US officials say the stolen crypto helps pay for.

Agents watched the attackers turn the stolen coins into Ethereum. The FBI expects the funds to be "further laundered by converting them using DeFi and instant swap services." That is the part exchanges fear most. Once money runs through enough hands, freezing it gets hard.

North Korea's hacking teams have had a heavy year. Chainalysis has tied most of 2026's crypto theft losses to the country, a pattern BTC Newz has covered before. This raid dwarfs them all. The previous record, the Bybit theft of early 2025, took about $1.5 billion.

The 628 wallets and the race to freeze funds

The alert doubled as a blocklist for the whole industry. It named 628 addresses: 608 on Ethereum, 19 on Bitcoin, and one on Solana. The agency asked THORChain, RPC node operators, instant exchanges, DeFi platforms and analytics firms to refuse any transaction that touches those wallets.

Chainalysis gave one reason it moved so quickly. It said the Binance funds mixed on-chain with money from September's theft at the exchange Bitget, which the firm had also tied to North Korea. Same wallets, same patterns. The firm flagged automated laundering too, with many addresses passing on funds moments after receiving a tiny one-token test payment.

Some funds were caught early. The US Secret Service said on November 1 that it froze "a significant portion of stolen cryptocurrency" within minutes of the attack, working with industry partners. Chainalysis put early freezes at about $2.8 billion by the afternoon of October 29. By November 1 the firm said more than $500 million had already moved through over 1,000 Tron addresses and was drifting toward Solana.

Detail is thin. The alert says little about how the break-in happened, and no person has been charged. No names. No arrests. Naming a state unit is not the same as catching anyone.

Binance says it has covered the loss

Binance moved fast to reassure customers. Richard Teng, the exchange's co-CEO, called the breach a "complex attack" that began with a compromised laptop and software built to erase evidence. "Your assets are safe," he wrote. The company said it has replenished about 90 percent of the stolen funds from its own balance sheet and set aside roughly $6.34 billion to cover the rest.

After the hack, the exchange suspended deposits and withdrawals, then reopened them in phases, starting with Bitcoin. Teng said the final tenth of the loss sits in less liquid tokens that may take longer to sell. Binance later added that its inquiry had found more than that one laptop.

Those recovery figures come from Binance itself. No independent audit has confirmed them. For now, customers are trusting the company's word that the hole is filled.

What to watch

Laundering is the next test. The FBI, the Secret Service and firms like Chainalysis are tracking the coins as they hop across Tron, Solana and cross-chain bridges. Each freeze depends on an exchange or protocol acting on the blocklist. Some will. Some will not.

Markets have stayed calmer than the headline number suggests. Bitcoin traded near $77,011 at 17:57 UTC on November 2, according to CoinGecko, down from the low $80,000s before the hack but far from a rout. US midterm elections on November 3 give traders a second thing to weigh this week.

Watch two things from here. Whether the FBI or the Justice Department charges anyone, and how much of the $6 billion ever comes back. On past North Korean thefts, the record is not encouraging.