FBI attributes $6B+ Binance theft to North Korea

On October 31, 2026, the FBI attributed the theft of more than $6 billion in virtual assets from Binance to North Korea. The bureau dates the theft to on or about October 29. The statement was published on its official website.

Attribution and asset movements

The FBI calls this North Korean cyber activity TraderTraitor. Together with the US Secret Service (USSS) and IRS Criminal Investigation (IRS-CI), it observed the actors converting stolen assets primarily into Ethereum (ETH).

The agencies expect further laundering through DeFi and instant swap services, in preparation for subsequent laundering stages.

Appeal to crypto services

The FBI, USSS and IRS-CI urged private-sector entities to block transactions with, or derived from, addresses used to launder the assets. The appeal includes THORNode and RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers.

The notice lists addresses operated by, or closely connected to, TraderTraitor actors that hold or have held stolen assets. The FBI asks anyone with information to contact a local field office or IC3.

An earlier TraderTraitor attribution

On February 26, 2025, the FBI used the same designation when attributing the theft of approximately $1.5 billion from Bybit to North Korea. That theft occurred on or about February 21. The earlier notice reported conversions into Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains.

Official sources: FBI: Binance statement, October 31, 2026 · FBI / IC3: Bybit statement, February 26, 2025