Crypto / Cybersecurity / North Korea
The bureau's Saturday alert turns a private suspicion into an official accusation: the same North Korean operation behind the $1.5 billion Bybit theft now stands blamed for a heist four times larger — and the race to launder it is already under way.
Track it live: Crypto prices and market tracker, live — Signal Post News Live Global Trackers
WASHINGTON, October 31, 2026 — The question hanging over the Binance hack — North Korea or not — got an official answer on Saturday. The Federal Bureau of Investigation published a cyber alert stating that the Democratic People's Republic of Korea “was responsible for the theft of more than $6 billion USD in virtual assets” from Binance, the world's largest cryptocurrency exchange, “on or about October 29, 2026.” The bureau names the activity “TraderTraitor,” the same North Korean operation it blamed for the $1.5 billion theft from the Bybit exchange in February 2025, which was the largest crypto theft on record until this week. At roughly $6.3 billion by Binance's own accounting, this one is about four times larger.
The alert, issued jointly in effect with the US Secret Service (USSS) and IRS Criminal Investigation (IRS-CI), does more than accuse. The three agencies say they have observed TraderTraitor actors “converting stolen assets primarily into Ethereum (ETH),” expect the laundering to continue through decentralised finance (DeFi) platforms and instant-swap services, and urge node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions with or derived from the addresses the group is using. The FBI published a long list of Ethereum, Bitcoin and Solana addresses it says are holding or have held the stolen assets, and asked anyone with information to contact a local FBI field office or its Internet Crime Complaint Center at ic3.gov. The Associated Press reported the attribution on Saturday afternoon, calling the theft “the biggest crypto heist in history.”
What happened on October 29
The money left fast. Blockchain intelligence firm TRM Labs traced about $6.36 billion leaving Binance wallets across 10 blockchains, most of it in roughly 20 minutes starting at about 4:05 p.m. ET on Thursday, October 29. Binance initially described a “security incident,” paused deposits and withdrawals, and said user funds were safe. Its initial investigation, as reported by The Times and other outlets, pointed to a compromised engineer's laptop that gave the attacker access to a service system from which unauthorised withdrawals could be ordered; Binance has said it found no evidence of a wallet private-key leak.
The freeze race: stablecoin issuers can switch tokens off, and they did — about $3 billion of the stolen assets was frozen on-chain through cooperation with token issuers and industry partners, including more than $1.567 billion in USDT frozen by Tether and more than $800 million in USDC frozen by Circle, with Ripple also freezing roughly $200 million. That is why the attackers' conversion into ether matters: ether has no issuer who can blacklist it.
Binance's cover promise: co-founder Yi He said Binance would cover all hacking losses; the company says it has set aside more than $6.34 billion of its own funds, and on Saturday said it had replenished about 90% of the stolen assets by buying less-liquid tokens in market and over-the-counter channels. It targets a staged reopening of withdrawals from Sunday, November 1, subject to security checks, with proof-of-reserves results not expected before Monday. Former CEO Changpeng Zhao posted that the incident “did look like a hack” and that user funds are safe.
From a firm's suspicion to a government's accusation
Precision matters here. Until Saturday, the North Korea link rested on private attribution: TRM Labs said “with high confidence” that TraderTraitor carried out the attack, Chainalysis expressed a “high degree of confidence” after seeing proceeds of last month's Bitget exploit mixed with Binance funds, and Elliptic called the incident “almost certainly the single largest known theft of any kind.” Those were expert claims, not findings by any state — and Binance itself still has not endorsed the North Korea link, telling reporters only that it is “working closely with our law enforcement partners to confirm the identity of the criminals.”
The FBI alert changes the legal and practical footing. A government attribution is what turns a blocklist from a courtesy into an industry-wide instruction: the agencies are asking infrastructure — THORChain node operators, RPC node operators, DeFi front-ends — to refuse the money. Note the limit, though: as analysts have pointed out, the alert is a request, not a sanctions designation or a court order, so each firm still needs its own legal basis to act. North Korea, for its part, routinely denies state hacking; its mission in Geneva and embassy in China had not commented on the Binance hack as of Saturday, The Times reported.
The laundering race is the story now
Attribution does not recover a single token; interdiction might. AP quoted crypto expert Ari Redbord expecting the hackers to break the stolen assets into pieces and launder them through smaller exchanges over months. On-chain reporting on Saturday evening showed most of the converted ether still sitting still — two attacker wallets held 214,720 ETH, worth about $484 million, unmoved since early Friday — and about $2 billion in stablecoins frozen in the attacker's main wallet after Tether and Circle blacklisted it.
One accident helped the defenders: Chainalysis said on Saturday that an Ethereum block reorganisation caused THORChain to issue a duplicate refund, triggering an emergency pause that “inadvertently delayed the laundering of a significant amount of funds stolen from Binance.” A decentralised swap network stopping — even by accident — is now a plot point in a state-level money-laundering operation, which tells you where this contest is actually fought: not in courtrooms first, but in node software.
Why this matters
Scale in context: Chainalysis data cited this week puts North Korea's 2025 crypto theft at a record $2.02 billion — about 60% of the $3.4 billion stolen worldwide that year — and suspected North Korean hacks at nearly 89% of reported crypto hack losses so far in 2026. US officials have long said these thefts fund Pyongyang's weapons programmes, which is why a single 20-minute operation worth $6.3 billion is a sanctions-evasion event, not just a corporate embarrassment. It exceeds the entire recorded 2025 global crypto theft total by itself.
Who loses, who is shielded: Binance says customers will not lose money, and its $6.34 billion cover fund is the reason this is a reputational crisis rather than a bank run — so far. The costs land elsewhere: on the exchange's reserves, on market confidence (Coinbase shares fell 10.6% on October 30, bitcoin slid to a six-week low of $77,646 and ether to a two-month low in the first sessions after the hack), and on every smaller platform now being asked to police wallet addresses at infrastructure level. Critics of that model note the tension: an industry built on permissionless transfers is surviving its largest theft by asking its pipes to refuse service — effective, perhaps necessary, and a genuine philosophical concession.
The engineer's-laptop detail matters beyond Binance: if the reported entry point holds, the largest theft in crypto history did not break cryptography at all. It broke a person, a laptop, and a permission — the same human layer behind the Bybit theft, which investigators said began with a compromised developer machine. Hot wallets holding billions, reachable through credentials a single workstation can carry, are the industry's structural wager.
What happens next
Sunday is the trust test: a staged withdrawal reopening that goes smoothly tells customers the cover promise is real; a delay reopens every question. Monday's proof-of-reserves will be read line by line.
Watch three things after that: whether major DeFi and swap services publicly adopt the FBI address list; whether the frozen roughly $3 billion converts into recovered funds or stays stranded; and whether Washington follows attribution with sanctions designations or indictments, as it did after earlier North Korean thefts. The FBI has now said, on the record, who it believes emptied Binance. Proving it in a form that gets the money back is a different, slower contest — and on Saturday's evidence, it has barely begun.
Related coverage: Bitget Confirms $352 Million Crypto Theft Across Hot and Warm Wallets · Chainalysis Confirms Breach After Attacker Used 'Offensive Agentic Techniques' to Reach Internal Tools · Binance Faces US Criminal Probe Over Alleged Iran Sanctions Breaches
Sources
- FBI, “North Korea Responsible for $6 Billion+ Binance Attack,” FBI Cyber alert, October 31, 2026 — the attribution itself: DPRK responsible for the theft of more than $6 billion on or about October 29; TraderTraitor; conversion into ETH observed with USSS and IRS-CI; the block request and the published ETH/BTC/SOL address list; ic3.gov contact.
- Associated Press (October 31, 2026) — FBI blames North Korea for the stolen billions in the biggest hack in history; TraderTraitor behind the $1.5 billion Bybit hack; Ari Redbord on laundering through smaller exchanges; Binance's 90% cover statement.
- The Times (October 31, 2026) — $6.3bn involved; about $3bn frozen; Yi He cover promise; proof of reserves not before Monday; the compromised engineer's laptop in the initial investigation; Elliptic's “single largest known theft of any kind”; North Korea had not commented.
- Reuters reporting (October 29-30, 2026) — the original breach and freeze reporting, the stablecoin freezes (Tether, Circle, Ripple), and the market fallout: bitcoin's six-week low of $77,646, ether's two-month low, BNB down more than 8%.
- TRM Labs / Chainalysis (October 30-31, 2026) — TRM's $6.36 billion across 10 blockchains in about 20 minutes and its high-confidence TraderTraitor attribution; Chainalysis's high degree of confidence, its North Korea theft statistics ($2.02 billion in 2025), and the THORChain pause that inadvertently delayed laundering.