FBI blames North Korea for $6B Binance hack, urges blocks

The FBI has formally blamed North Korea for the theft of more than $6 billion from Binance. In a notice issued Saturday, October 31, the bureau named the state-backed hacking operation it calls TraderTraitor and asked the crypto industry to block transactions tied to the stolen funds. The notice says the theft took place "on or about October 29, 2026." It also says investigators saw the hackers converting stolen assets mainly into Ethereum ↘ 0.48%, and that they expect further laundering through decentralized finance (DeFi) and instant swap services.fbi.gov

This is the first time the U.S. government has officially named who carried out what AP calls the biggest crypto heist in history. It confirms what private blockchain investigators had said within hours of the attack.apnews.com

Blocklist of hundreds of wallets

The FBI issued the notice together with the U.S. Secret Service and IRS Criminal Investigation. It lists 608 Ethereum addresses, 19 Bitcoin ↘ 0.62% addresses and one Solana ↘ 1.07% address that hold or once held stolen assets. The agencies asked crypto exchanges, THORNode and RPC node operators, DeFi services, blockchain analytics firms and other crypto service providers to block transactions with those addresses, or with funds that came from them. The same group was blamed for the $1.5 billion theft from Bybit in February 2025.afp.com+3

Analysts got there first

Chainalysis named TraderTraitor as the culprit at 12:30 a.m. Eastern on October 30. It put the theft at about $6.4 billion and said stolen Binance funds had mixed on-chain with money from September's Bitget theft, which had already been tied to North Korea. TRM Labs put the total at about $6.36 billion and said it was making the call "with high confidence." TRM said most of the money moved in about 20 minutes across ten blockchains.altcoinbuzz.io

Binance estimates its losses at about $6.3 billion. It says about $3 billion has been frozen on-chain with help from partners, and its early investigation points to a compromised DevOps engineer's laptop. Stablecoin issuers Tether and Circle were among those that froze funds.apnews.com+1

Recovery and remaining funds

According to Reuters, Binance says it has covered $6 billion of the losses by using company money to buy replacement tokens. The exchange said Sunday that it had resumed withdrawals, reopening them in phases starting with the Bitcoin network.gmanetwork.com+2

A large share of the money is still out of reach. TRM estimates the attacker holds more than 420,000 ETH and 18,270 BTC, "about USD 2.4 billion in assets beyond any issuer's reach". That is why the FBI is asking the companies that run crypto's infrastructure to refuse the flagged funds.altcoinbuzz.io