FBI ties record Binance theft to North Korea’s TraderTraitor

The FBI attributed the theft of more than $6 billion in virtual assets from Binance to North Korea, identifying the activity as TraderTraitor. The bureau said the attack happened on or about October 29 and that it and federal partners had observed the stolen assets being converted primarily into Ether. The FBI’s October 31 alert asks crypto firms and infrastructure operators to block transactions connected to addresses linked to the laundering effort.

The attribution makes the incident the largest crypto theft on record, according to the Associated Press, surpassing the $1.5 billion Bybit hack that the FBI also attributed to TraderTraitor in 2025. The Binance loss is reported as $6.3 billion by AP; the FBI’s alert describes it as more than $6 billion. The scale changes the immediate question from attribution alone to whether the funds can be tracked and whether Binance’s stated plan to make customers whole can be carried through.

How does the Binance theft compare with the Bybit hack?

The reported Binance loss is more than four times the $1.5 billion taken from Bybit in 2025, the prior benchmark in the FBI’s own account of TraderTraitor-linked thefts. AP reported that the Binance assets were stolen within minutes. The FBI’s public notice does not describe the access method or provide a technical account of how the theft was carried out, so the available official details establish the scale, date and attribution, but not the breach mechanism.

The connection to Bybit gives investigators a prior case involving the same named activity, but it does not itself show that the assets will be recovered. The FBI said it expects the attackers to move the assets through decentralised finance services and instant swaps as they prepare further laundering stages. Those channels are the agency’s stated concern; the notice does not say that all such conversions can be stopped.

What can tracing and blocking achieve?

The FBI, US Secret Service and IRS Criminal Investigation are asking exchanges, DeFi services, instant exchanges, blockchain analytics firms and operators of THORNode and RPC nodes to block transactions involving identified addresses or funds derived from them. The bureau has published addresses it says are holding or have held assets from the theft and are operated by, or closely connected to, TraderTraitor actors.

That request creates a response across several types of crypto infrastructure rather than relying on a single exchange to monitor the funds. If service providers act on the listed addresses, they may make it harder to move or convert associated assets through those services. But blocking transactions is not the same as returning funds to customers, and the FBI’s alert does not quantify how much can be blocked or recovered.

What is Binance promising, and what comes next?

Binance told AP it had set aside enough of the same digital assets that were stolen to cover 90% of the missing amount and promised full reimbursement to customers. That commitment separates customer compensation from the uncertain process of tracing and recovering the stolen assets; the report did not provide a timeline for repayment.

The next signals are whether the stolen Ether moves into DeFi or instant-swap services, whether the listed addresses generate attempted transactions that providers can block, and how Binance fulfils its reimbursement promise. The FBI’s alert establishes attribution and a coordinated request to impede laundering. The amount ultimately recovered, and the time it takes, remain open.

Sources and documents

• FBI’s October 31 alert — fbi.gov