FBI Names North Korea’s TraderTraitor in $6 Billion-Plus Binance Theft

The Federal Bureau of Investigation on October 31, 2026 attributed the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance to North Korea, releasing an advisory that identifies the Democratic People’s Republic of Korea as responsible and names the malicious cyber activity “TraderTraitor.” The theft occurred on or about October 29, 2026.

The FBI, together with partners at the U.S. Secret Service and IRS Criminal Investigation, has observed TraderTraitor actors converting the stolen assets primarily into Ethereum, the advisory states. The bureau expects the assets to be further laundered through conversions on DeFi and instant swap services as the actors prepare them for further laundering stages.

The three agencies urged private sector entities — including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers — to block transactions with or derived from addresses the advisory lists as holding or having held assets from the theft. The list spans Ethereum, Bitcoin and Solana addresses that the FBI says are operated by or closely connected to North Korean TraderTraitor actors. The FBI Cyber Branch published the advisory text on X at 22:36:58 GMT on October 31, 2026.

The FBI said it maintains its commitment to protecting the virtual asset community by “identifying, mitigating, and disrupting North Korea’s illicit cybercrime and virtual asset theft activities,” and asked anyone with information to contact a local FBI field office or the Internet Crime Complaint Center at ic3.gov.

How the October 29 Theft Unfolded

Blockchain intelligence firm TRM Labs, which published its own investigation of the theft on October 29, 2026, reported that approximately $6.36 billion moved out of Binance wallets across ten blockchains starting at 20:05 UTC, most of it in about 20 minutes, with a second wave around 23:05 UTC reaching Binance wallets on Avalanche and Polygon. TRM attributed the attack to TraderTraitor with high confidence, citing on- and off-chain intelligence, and described it as the largest crypto theft on record, about four times the February 2025 Bybit hack. Its figures reflect onchain data as of October 30, 2026 at 00:30 UTC.

TRM counted about $2.7 billion frozen onchain: approximately 1.77 billion USDT frozen by Tether, about 825 million USDC by Circle, 40.5 million RLUSD by Ripple, and 27.8 million USD1 by World Liberty Financial, while Arbitrum’s Security Council used its emergency powers to force 8,426 ETH and 74.6 million ARB, worth about $30 million, out of the attacker’s wallet on Arbitrum. Even after those actions, TRM reported, the attacker held more than 420,000 ETH and 18,270 BTC, about $2.4 billion in assets beyond any issuer’s reach.

On Ethereum, the attacker used an EIP-7702 delegation containing 50 pre-signed authorizations to turn a Binance hot wallet into a sweeper it controlled, according to TRM’s report. EIP-7702, introduced in Ethereum’s Pectra upgrade in May 2025, lets an ordinary wallet hand control of its behavior to a smart contract by signing an authorization. Because Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers in the same window, TRM assessed that the most likely explanation is a compromise of Binance’s hot wallet signing infrastructure. Binance had yet to publish a root cause at the time of TRM’s report.

Earlier Bybit Attribution

The FBI has applied the TraderTraitor designation before. In a February 26, 2025 public service announcement (Alert Number I-022625-PSA), the bureau advised that North Korea was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange Bybit on or about February 21, 2025. That announcement said TraderTraitor actors were proceeding rapidly and had converted some stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains, and that the assets were expected to be further laundered and eventually converted to fiat currency. The Bybit alert made a similar blocking request to RPC node operators, exchanges, bridges, blockchain analytics firms, DeFi services and other virtual asset service providers, and published a list of Ethereum addresses.

Binance, in its third recovery update on October 31, 2026, said it had replenished 90% of stolen assets after setting aside more than $6.34 billion in company funds, drawing on a partial deployment of its Secure Asset Fund for Users, a portion of its Futures insurance fund and its corporate treasury. The exchange said BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were fully backed 100%, that it took a new Proof of Reserve snapshot at 00:00 UTC on October 31, 2026, with the full zero-knowledge proof estimated by November 3, 2026, and that it remained on track to resume withdrawals on November 1, 2026.