FBI Blames North Korea for $6B Binance Hack as Exchange Reopens Withdrawals

What it is

The FBI alert of 31 October 2026 attributes the theft of more than $6 billion in virtual assets from Binance, on or about 29 October 2026, to North Korea's "TraderTraitor" group. TRM Labs and Chainalysis had made the same attribution on 30 October. The Secret Service and IRS Criminal Investigation are also involved. The page does not say how the attackers got in.

How it works

The FBI says the hackers are converting stolen assets mainly into Ethereum. It expects them to launder the funds further through DeFi and instant swap services.

Chainalysis reported the following on 1 November:

• More than $500 million moved on Tron through over 1,000 addresses, over 3,000 deposits and several Tron-based DeFi protocols.
• Most of those staging wallets are now drained.
• Funds left Tron through Chainflip, Relay, THORChain and NEAR into dozens of fresh wallets on Ethereum, Bitcoin and other chains.
• The launderers have started moving onto Solana.

What to do

The FBI asked these parties to block transactions involving the listed addresses: node operators, instant exchanges, DeFi services, blockchain analytics firms and other crypto businesses. The list has hundreds of Ethereum addresses, 19 Bitcoin addresses and one Solana address. The page does not reproduce the list, so it has to be taken from the FBI alert itself.

For anyone running screening or monitoring, the Chainalysis findings point to cross-chain bridges and swap services (Chainflip, Relay, THORChain, NEAR) as the exit path from Tron. They also point to newly created wallets on Ethereum, Bitcoin and Solana as the next hop.

Caveats

• The Secret Service says it worked with industry partners to freeze "a significant portion" of the stolen crypto within minutes. Reuters reported that Circle froze more than $1.1 billion in USDC. The page gives no total for recovered or frozen funds.
• Binance's claim that it replenished about 95% of affected assets comes from CEO Richard Teng. Binance says it raised $6 billion from its corporate treasury, an insurance fund and its SAFU fund.
• Binance reports $4.649 billion in withdrawals and $1.01 billion in deposits in the first nine and a half hours after reopening on 1 November. That is a net outflow of about $3.64 billion, or 2.1% of the $171 billion in its 28 October proof of reserves. An updated reserves report was expected on 2 November.
• DefiLlama put Binance's assets at about $127.6 billion on 2 November. CoinDesk reported more than $6 billion left Binance-linked wallets in 24 hours, but those figures can include transfers between Binance's own wallets.
• OKX and Bybit saw net inflows of about $450 million and $134 million. Spot Bitcoin ETFs lost $643.2 million on 30 October.