Global · Regulation & crypto · Source: fbi.gov · News archive (older than 3 days)

FBI attributes $6 billion-plus Binance theft to North Korean hacking group

Published 31 Oct 2026

Editor: Hedal Kolanyi / AI-assisted

Corrections: none so far. Spotted an error? Tell us via the Contact page.

Summary: The FBI said on 31 October that North Korea was responsible for stealing more than $6 billion in digital assets from the Binance exchange around 29 October. US agencies have asked the crypto industry to block transactions linked to the attackers' addresses.

What happened

In a cyber alert, the FBI said the theft took place "on or about October 29, 2026". It attributed the theft to North Korean actors that it tracks under the name "TraderTraitor". Working with the US Secret Service and IRS Criminal Investigation, the FBI said it had seen the stolen funds being converted, mainly into one other cryptocurrency, which the FBI named, and expected further laundering through decentralised finance (DeFi) and instant-swap services. The alert published a list of blockchain addresses. It urged node operators, exchanges, DeFi services and blockchain analytics firms to block transactions with or derived from them.

According to CNBC, Binance has resumed withdrawals. The exchange said it had restored backing for about 90% of the affected assets, drawing on its user-protection fund, part of an insurance fund and its corporate treasury. CNBC noted that this does not mean 90% of the funds have been recovered from the attacker.

Background

Blockchain analytics firm Chainalysis said in its own assessment that unauthorised transfers of about $6.4 billion began at around 4:20 p.m. US Eastern time on 29 October. It called this the largest theft in crypto history. It said stablecoin issuers began freezing funds within the hour and that about $2.8 billion had been frozen as of its latest update on 30 October. Yonhap reported that blockchain intelligence firm TRM Labs had earlier linked the theft to the same group. The exact way the attack was carried out has not been fully explained publicly.

Why it matters for markets and crypto

The case shows how much an attack on one large platform's systems can affect the wider market's infrastructure. It also highlights a growing area of cooperation, in which law enforcement, stablecoin issuers and analytics firms act together to trace and freeze stolen funds. The FBI alert is directed at the attackers. It makes no allegation against Binance, which it names as the exchange the assets were stolen from. This is general information and does not express a view on any asset or company.

What to watch next

No fixed dates: further FBI or industry updates on traced or frozen funds.
No fixed dates: Binance's progress on covering the remaining affected assets, which it says it is still sourcing.
No fixed dates: any statements from regulators on how crypto platforms in general protect customer assets.

Sources

Disclaimer: Xorchain Economy news is provided for general information only. It is not financial, investment, legal or tax advice, and it is not an offer or recommendation to buy, sell or hold any asset. Articles are written in our own words from official and other public sources, which are credited and linked at the end of each article. Short quotes are attributed to their authors. Articles are prepared with AI assistance and reviewed by the editor before publication. Figures may be revised by the source, and the original publication prevails. Xorchain is an early-stage project, has no token for sale, and has no affiliation with the institutions mentioned unless stated. Do your own research and consult a qualified adviser before making financial decisions.

Conflict of interest: xorchain.io is an early-stage blockchain project; the author has an interest in it. This is not investment advice.

Related news

Ad disclosure: if we show affiliate links, we mark them as ads, and we may earn a commission if you sign up through them. Not financial advice.