FBI Says North Korea Behind $6 Billion Binance Heist

It’s official – for what it’s worth: North Korea “was responsible for the theft of more than $6 billion USD in virtual assets” from Binance on Thursday, according to a Saturday FBI cyber alert. The agency says says Kim Jong Un’s ‘TraderTraitor’ hacking operation was responsible. 

The FBI is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North… pic.twitter.com/TBUvUFln4n

— FBI Cyber Branch (@FBICyberBranch) October 31, 2026

As we reported Thursday, TRM Labs and Chainalysis blamed N. Korea within a day, while Tether and Circle froze billions in stolen stablecoins. TRM puts the haul at $6.36 billion and calls it the largest hack in history; Chainalysis said its investigators concluded that the Binance loot was “commingling” with funds North Korea from last month’s Bitget exploit.

Our investigators observed funds stolen by DPRK in last month’s Bitget exploit commingling with funds stolen from Binance.

We have a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance. https://t.co/xj9dQYcbKr

— Chainalysis (@chainalysis) October 30, 2026

Working in conjunction with US Secret Service and IRS Criminal Investigation, the FBI says it has “observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH),” and that “it is expected these assets will then be further laundered by converting them using DeFi and instant swap services.” It published 628 addresses it says “are holding or have held assets from the theft” – 608 on Ethereum, 19 on Bitcoin and one on Solana.

The agencies are urging “THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from” those addresses. The list may already be falling behind: Chainalysis CEO Jonathan Levin told CoinDesk the attackers have used “thousands of addresses,” adding, “We anticipate this will become tens of thousands over the coming weeks.”

Binance, meanwhile, insists its customers won’t eat the loss. As we reported last night, the exchange said it had replaced 90% of the roughly $6.3 billion with its own funds, and on Sunday it began reopening withdrawals in phases, starting with the Bitcoin network. Co-CEO Richard Teng put the replenished share at about 95% on Sunday, according to crypto.news.

Update: First batch network now opened in phase one of withdrawals is $BTC bitcoin network https://t.co/jSeeorSKGD

— Binance (@binance) November 1, 2026

Teng said Friday that Binance’s initial investigation suggests the breach “may have started with a compromised DevOps engineer’s laptop.”

I want to speak to you directly about what happened.

Bottom line – your money is safe, and we’re covering every loss.

Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop. That gave an attacker access to a…

— Richard Teng (@_RichardTeng) October 30, 2026

The bureau’s call came a day after President Trump was nonplussed at the whole thing. “I’m not concerned. We’re learning about it. We don’t know if it’s North Korea, but if it is, we’ll talk to them about it,” Trump told reporters on Friday, according to Fox Business, adding: “I think the bloodbath of AI hacking is to come.” We found no response from Pyongyang to the alert.

The FBI blamed the same North Korean activity for the $1.5 billion Bybit theft in February 2025, the record until now. At more than $6 billion, the Binance haul is roughly four times that.