FBI Ties $6B Binance Theft to North Korea’s TraderTraitor

WASHINGTON, Nov. 1, 2026 — The FBI has attributed the theft of more than $6 billion in cryptocurrency from the exchange Binance to North Korea, naming the hacking group the bureau tracks as TraderTraitor. In an alert published Oct. 31, the FBI said the theft occurred on or about Oct. 29, that it was working with the U.S. Secret Service and IRS Criminal Investigation, and that the stolen assets were being converted mainly into ether.

If the figures hold, it is the largest theft in the history of digital assets. The blockchain analytics firm Elliptic counts $6.43 billion taken across 11 blockchains in about three hours, against Binance’s own estimate of about $6.3 billion. This article tracks how fast the U.S. government has named North Korea in three TraderTraitor cases, how much of the haul was frozen, and why the speed of those freezes now matters to Pyongyang’s revenue.

How the theft unfolded

Elliptic’s on-chain reconstruction puts the first outflow at about 20:05 UTC on Oct. 29 (4:05 p.m. Eastern), with 233 million XRP leaving a Binance hot wallet. Chainalysis dates the broad outflows from Binance hot wallets to around 4:20 p.m. Eastern.

The largest share, $3.80 billion across 186 tokens, came from Ethereum, according to Elliptic. Bitcoin losses totaled 18,270 BTC, worth about $1.48 billion. Elliptic said the on-chain evidence suggests the attacker did not steal Binance’s private keys but got Binance’s own systems to sign authorizations under EIP-7702, an Ethereum feature that lets an ordinary wallet run smart contract code. One such hot wallet was swept of $2.53 billion in a single transaction at 20:24 UTC.

Binance first linked the breach to a compromised laptop belonging to a DevOps engineer and later said the attackers had used “additional points of breach,” according to Elliptic, which quoted co-Chief Executive Richard Teng saying the theft “was not carried out by one person.” Binance said it had reserved more than $6.34 billion to cover customer losses, and it began reopening withdrawals on Nov. 1, starting with bitcoin.

The race to freeze

Stablecoins can be frozen by their issuers, while bitcoin and ether cannot. Chainalysis said the attacker swapped $325 million in stablecoins for $285 million in ether over nearly 20 minutes, accepting a loss of about $40 million to get ahead of freezes. Elliptic said Tether froze 1.18 billion USDT about 37 minutes after the attack began and Circle froze 823 million USDC.

Elliptic counts $2.85 billion frozen or seized, about 44% of the total. By that tally, roughly $3.6 billion remained in assets the attackers could move, a figure that is Peter’s World’s arithmetic from Elliptic’s numbers rather than an official estimate.

Three cases, shrinking attribution times

The FBI has publicly tied TraderTraitor to each of the following thefts. The “days to attribution” column is calculated by Peter’s World from the dates in each FBI statement.

In the DMM case, the FBI, the Defense Department’s Cyber Crime Center and Japan’s National Police Agency said a TraderTraitor operator posed as a recruiter on LinkedIn and sent a Python “pre-employment test” to an employee of Ginco, a Japanese wallet software company. The agencies said the group is also tracked as Jade Sleet, UNC4899 and Slow Pisces. The FBI’s Bybit alert used the same language as the Binance notice, asking node operators, exchanges and bridges to block transactions tied to the listed addresses.

The trend line in the table is the original finding here: the government’s public naming of North Korea has gone from months to days. Chainalysis reported its own attribution about eight hours after the outflows began, citing on-chain links to funds from last month’s theft at the exchange Bitget.

Analysis: why the speed of attribution matters

A theft of this size is a sanctions problem as much as a crime. Elliptic estimated that North Korea-linked actors had stolen more than $6.5 billion in recent years before this incident, which would put the Binance haul near the total of every earlier heist combined. The U.S. government has said such proceeds help fund Pyongyang’s weapons programs, and Elliptic repeated that link in its report.

Fast public attribution changes the economics. Once the FBI publishes addresses, compliant exchanges, over-the-counter brokers and cross-chain services face legal exposure for touching the funds, which raises the cost of laundering. That is why the bureau’s alert names infrastructure operators, not just victims. The freeze data show the limit of that approach: issuers stopped about 44% of the haul, but the balance had already been converted into assets that no company can freeze.

The method also deserves attention. The DMM case began with a fake job offer to one employee, and Binance’s account begins with one engineer’s laptop. Both point to people and developer tooling, rather than exchange cryptography, as the weak link. For regulators, the question after Binance is whether hot wallets holding billions should face custody rules closer to those of banks. For North Korea watchers, it is how much of the remaining $3.6 billion reaches cash, and how quickly.

What to watch

• Updated FBI address lists and any Treasury sanctions on brokers or services that handle the funds.
• Binance’s full post-incident report on the “additional points of breach.”
• Whether more of the converted ether is frozen as it moves through exchanges.

Sources

• FBI: North Korea Responsible for $6 Billion Binance Attack (Oct. 31, 2026)
• FBI: North Korea Responsible for $1.5 Billion Bybit Hack (Feb. 26, 2025)
• Elliptic: Binance suffers largest hack in history
• Chainalysis: Binance exploit latest findings and response

Additional sources

• The Washington Post (AP): FBI says North Korea behind $6 billion Binance crypto theft, Oct. 31, 2026

Related coverage

• Information War Update: Oct. 30
• Salt Typhoon vs. Volt Typhoon
• Indo-Pacific Security Update: Nov. 1