FBI blames North Korea for $6 billion Binance heist, urges crypto firms to block linked addresses

The FBI's attribution

The FBI said on Saturday that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about 29 October 2026, attributing the attack to the North Korean hacking group it calls TraderTraitor.

The bureau said it had observed TraderTraitor actors converting the stolen assets mainly into Ethereum, and expected them to launder the funds further through decentralised finance platforms and instant swap services.

TraderTraitor is described by the FBI and analysts as a subunit of the Lazarus Group, the same group blamed for the $1.5 billion theft from the Bybit platform in February 2025.

Hundreds of addresses to block

In the same notice, the FBI listed more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address that it said currently hold or at some point held funds from the hack, and urged the crypto community to block transactions from them.

The appeal, issued jointly with the US Secret Service and the IRS Criminal Investigation division, was directed at THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers, asking them to block transactions with or derived from the attackers' addresses.

Chainalysis said the attackers had already used thousands of addresses and expected the number to reach tens of thousands in the coming weeks, as the scale of the haul overwhelms the group's usual laundering venues. Stablecoin issuers have already frozen more than $2.4 billion of the stolen funds, CoinDesk reported.

What is confirmed, and what is not

The North Korea attribution is the FBI's finding, based on its investigation with the Secret Service and IRS-CI. It confirms earlier suspicions from private analysts, but it has not been independently verified in public, and US President Donald Trump publicly cast doubt on it, telling reporters: “We don't know if it's North Korea.”

The size of the theft is also reported differently: the FBI put it at more than $6 billion, while CoinDesk reported about $6.4 billion. The attack is widely described as the biggest crypto heist on record, but that characterisation rests on the reported totals rather than a single audited figure.

Binance, meanwhile, said it had set aside more than $6.34 billion in company funds to cover the losses, had replenished about 90% of the stolen assets, and began resuming withdrawals in phases from Sunday, starting with major tokens on the Bitcoin network and on Ethereum and BNB Smart Chain.

Why the case matters

The case has put a spotlight on how North Korea, under extensive sanctions over its nuclear and missile programmes, seeks revenue through cyber theft, and on the difficulty of stopping laundering once stolen funds scatter across thousands of addresses and decentralised tools.

For exchanges and analytics firms, the FBI's list turns a fast-moving investigation into a compliance task: every new address the attackers spin up must be spotted and blocked before the funds move again.

Editorial disclosure

This article was researched with AI assistance and reviewed by the publisher before publication. Report factual errors through our contact page.