TLDR
- The FBI says North Korea’s TraderTraitor group stole about $6.3 billion from Binance on Thursday.
- The hackers are mostly converting the funds into Ether and are expected to use DeFi tools next.
- The FBI listed over 600 Ethereum addresses, nearly 20 Bitcoin addresses and one Solana address to block.
- Chainalysis says the attackers have used thousands of addresses and expects that to reach tens of thousands.
- Binance says it has replenished 90% of the stolen crypto and plans to resume withdrawals on Sunday.
The FBI says North Korea was behind the theft of about $6.3 billion in digital assets from Binance. The agency shared the finding in a news release on Saturday.
The FBI is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North… pic.twitter.com/TBUvUFln4n
— FBI Cyber Branch (@FBICyberBranch) October 31, 2026
Binance was hacked on Thursday. Some reports put the loss at $6.4 billion, and several analytics firms linked the attack to North Korea soon after it happened.
What the FBI Said About the Binance Hack
The FBI calls the group TraderTraitor. It is a subunit of the Lazarus Group, which has carried out other crypto exchange breaches.
The agency says the hackers have mostly converted the stolen funds into Ether. It expects them to use DeFi tools and instant swap services to launder the money next.
The FBI, the Secret Service and IRS Criminal Investigation asked private companies to help. They urged THORNode operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to block related transactions.
The notice lists over 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address. The full list is posted in the news release.
Stablecoin issuers have frozen more than $2.4 billion of the stolen funds. The attackers have kept laundering much of the rest.
Chainalysis Tracks a Growing Laundering Network
Chainalysis says the attackers have already used thousands of addresses. CEO Jonathan Levin expects that number to grow to tens of thousands in the coming weeks.
Levin said the hackers have too much money for their trusted laundering venues to handle. He said the funds will move to bridges, instant exchanges and swappers.
Chainalysis also said the attackers are using novel automated laundering mechanisms. Its blog post said the tools move funds between addresses to hide the trail.
North Korea has a long record of crypto theft. CertiK reported that groups tied to the country stole more than $2 billion of the $3.4 billion in crypto losses in 2025.
Cointelegraph reported that these hackers took about 60% of the value lost to hacks that year. The proceeds are used to help fund nuclear and ballistic missile programs.
CertiK estimates North Korea-linked actors stole about $6.75 billion across 263 incidents between 2016 and early 2026. Its analysis said the country has turned crypto theft into a core source of state revenue.
MilitarySpend estimates North Korea’s yearly defense spending at up to $6 billion, though the figure is uncertain. It says crypto theft adds off-budget financing for weapons programs.
Binance said on Saturday that it had replenished 90% of the stolen cryptocurrencies. The exchange plans to resume customer withdrawals on Sunday.
President Donald Trump was asked about the hack on Saturday. He said “we’re learning about it” and that his administration would talk to North Korea about it.
Stop guessing and start investing with confidence. KnockoutStocks gives you the AI insights, market intelligence, and stock research you need to spot opportunities, cut through the noise, and make smarter investment decisions — all in one powerful platform.
Sign up today and get 50% OFF full access to our premium stock picks.
Simply use coupon code SPECIAL50 at checkout to claim your exclusive discount.
