FBI Links Binance Theft to North Korea as Crypto Services Face Urgent Blocking Request
Date: 2026-11-01
FBI Links Binance Theft to North Korea as Crypto Services Face Urgent Blocking Request
U.S. investigators have attributed the theft of more than $6 billion to North Korean cyber activity and asked digital asset businesses to disrupt transactions linked to the stolen funds.
Key Points
- The FBI attributed the October 29 Binance theft to North Korean activity it tracks as TraderTraitor.
- Investigators observed stolen assets being converted mainly into ether and warned of further laundering through DeFi and swap services.
- Binance said it had replenished 90% of the affected assets by October 31 and would absorb the financial impact.
The FBI has attributed the theft of more than $6 billion in cryptocurrency from Binance to North Korea, turning the investigation into an urgent effort to interrupt the movement of stolen assets. In an October 31 notice, the bureau identified the activity as TraderTraitor and appealed to businesses across the digital asset industry for assistance.
Investigators follow conversions into ether
Working with the U.S. Secret Service and IRS Criminal Investigation, the FBI said it had observed the attackers converting stolen assets primarily into ether. Investigators expect decentralised finance platforms and instant swap services to feature in subsequent attempts to launder the funds.
The bureau asked exchanges, DeFi services, blockchain analytics companies and infrastructure operators to block transactions involving, or derived from, the identified addresses. Its notice includes addresses that currently hold stolen assets as well as those that previously received them.
A widening network of wallets
CoinDesk reported that the published list contains more than 600 Ethereum addresses, fewer than 20 Bitcoin addresses and one Solana address. That list represents only part of the activity described by blockchain investigators. Chainalysis chief executive Jonathan Levin told the publication that thousands of addresses had already been used and that the number could reach tens of thousands in the coming weeks.
The recovery effort now depends on tracing the funds and disrupting the services used to move them.
Editorial analysisBinance uses company resources to replace assets
Binance estimated the impact at approximately $6.3 billion. In its October 31 update, the exchange said it had covered 90% of the affected amount after reserving more than $6.34 billion in company funds. The remaining shortfall involved less liquid tokens that could take longer to acquire.
Replenishing those holdings is separate from recovering assets from the attackers. Binance said it was purchasing replacement tokens through market and over-the-counter channels and would bear the financial impact itself. Its stated plan was to resume withdrawals on November 1, with a further announcement to confirm details.
What remains unresolved
The FBI's attribution establishes the position of U.S. investigators, while tracing and recovery work continue. CoinDesk also reported that stablecoin issuers had frozen more than $2.4 billion connected to the theft. Frozen assets, replacement purchases and money still controlled by the attackers remain distinct parts of the response; none alone establishes how much has ultimately been returned.
