FBI Says North Korea's TraderTraitor Hackers Stole Over $6 Billion From Binance
The FBI tied the Binance theft to North Korean hackers and listed 628 addresses for the industry to block. Binance says it has restored backing for about 90% of the stolen assets.
The FBI says North Korea was behind the theft of more than $6 billion in crypto from Binance. In a cyber alert published Oct. 31, the bureau pinned the attack on a North Korean hacking operation it calls "TraderTraitor." It said the theft happened on or about Oct. 29.
The same day, Binance said it had restored backing for about 90% of the stolen assets. It is using its own reserve funds to do it. That does not mean the money came back from the hackers. It means Binance is covering the gap itself.
The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North… pic.twitter.com/TBUvUFln4n
The alert was issued with the U.S. Secret Service and IRS Criminal Investigation. According to the FBI, the TraderTraitor group has been converting the stolen funds mainly into ether (ETH). The bureau expects the hackers to run those funds through DeFi protocols and instant swap services next, as they move into later laundering stages.
The FBI listed the wallet addresses it says hold, or have held, assets from the theft. We counted 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address on the page. That is 628 in total.
Fueled Crypto Daily
Get the news, explained, by email.
The bureau asked a specific group of companies to block transactions linked to those addresses. The list includes THORChain node operators, RPC node providers, instant exchanges, DeFi services, blockchain analytics firms and other crypto service providers. Anyone with information is asked to contact a local FBI field office or file a report at ic3.gov.
Where Binance says it stands
Binance first disclosed the hack on Oct. 29, as we reported Oct. 30. Its third recovery update on Oct. 31 said about 90% of affected assets had been replenished.
Per Binance, the money came from part of its Secure Asset Fund for Users (SAFU), part of its futures insurance fund and its corporate treasury. Co-founder Yi He said on X that the exchange had allocated $6.34 billion. She said BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were fully backed.
We know how important trust is, especially in moments like this.
We've now replenished 90% of the stolen assets, and we're committed to covering the remaining 10%. Our users will not bear the financial impact of this incident.
CEO Richard Teng said users "will not bear the financial impact." Binance told CNBC that the remaining 10% is made up of smaller tokens outside its top 10. Those are less liquid and may take longer to buy back. The exchange said it will keep buying through the market and over-the-counter desks until every token reaches 100%.
Some of the stolen funds have been frozen. Binance said on Oct. 30 that about $3 billion had been frozen. CoinDesk, citing stablecoin issuers, put stablecoin freezes alone at more than $2.4 billion. The two figures measure different things, so they don't add up neatly.
Withdrawals restart
Early Nov. 1, Binance began reopening withdrawals in phases. Bitcoin went first. Ethereum and BNB Smart Chain followed, according to CNBC. Binance's fourth update put replenishment at about 95% and listed 15 networks for the first phase.
What it means for users
If you hold funds on Binance, the exchange says your balance is covered. Withdrawals are reopening network by network, so expect delays on some tokens. Watch for scams. Big hacks bring fake "refund" sites and fake support accounts. Binance support will never ask for your password or recovery phrase.
If you move funds to your own wallet, keep the recovery phrase offline. Never store seed phrases or private keys in a password manager or on a computer, phone or other electronic device. Write them on paper or metal and keep them somewhere safe. Our guide on what to do if your crypto is stolen covers the first steps after a loss.
What's next
Binance still has to cover the last 5% to 10% and finish reopening every network. Blockchain analysts expect the stolen ETH to be split across many more wallets. Chainalysis CEO Jonathan Levin told CoinDesk the hackers had already used thousands of addresses. He expects "tens of thousands" in the coming weeks. That would make the FBI's list a starting point, not a final count.
The French bank says attackers used its own account, not customer accounts. It validates the order of magnitude of reported losses, not a final figure.
The exchange's first incident report describes a months-long campaign. It ran through a tampered download, a rigged coding assignment and an abused internal AI tool.
