// AI threat desk · 15 Nov 2026
Home/AI-ATK · AI-Powered Attacks
AI-Powered AttacksMediumTRADERCVSS not assigned

Binance virtual assets: FBI attributes more than $6 billion to North Korea

The FBI attributed more than $6 billion in Binance virtual assets to North Korea’s TraderTraitor activity on or about Oct 29, 2026. The FBI and HKCERT disclosed the attribution on Oct 31, 2026.

· 2 min read
AI-generated image of cybersecurity analysts monitoring blurred cryptocurrency transaction dashboards in an operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • The FBI attributed the loss of more than $6 billion in Binance virtual assets to North Korea on or about Oct 29, 2026.
  • The FBI calls the activity TraderTraitor and observed the assets being converted primarily into Ether.
  • The FBI published addresses connected to the incident and urged virtual-asset businesses to block related transactions.

The FBI said North Korea was responsible for the loss of more than $6 billion in virtual assets from Binance on or about Oct 29, 2026, and identified the activity as TraderTraitor.

The FBI said it observed the actors converting the assets primarily into Ether. It expects the assets to be further laundered through decentralized-finance and instant-swap services.

Binance is a cryptocurrency exchange. The Secret Service said investigators and industry partners identified and froze “a significant portion” of the cryptocurrency within minutes of the attack.

On this page

Binance estimated the impact at approximately $6.3 billion

Binance estimated the financial impact at approximately $6.3 billion. Its initial investigation suggested that a compromised laptop belonging to a DevOps engineer may have enabled unauthorized withdrawals, the company said.

Binance later identified additional breach points, meaning the full attack path remains under investigation rather than established as a single device compromise.

The FBI urged blocks across Ethereum, Bitcoin and Solana addresses

Chainalysis said the hackers moved more than $500 million on Tron through more than 1,000 addresses, over 3,000 deposits and several Tron-based DeFi protocols.

NetworkAddresses
EthereumHundreds
Bitcoin19
SolanaOne

HKCERT said the alert lacked a complete technical chain

HKCERT said the FBI alert did not identify an exploited vulnerability, a malware family or a complete technical chain.

Binance said it processed $4.649 billion in withdrawals and $1.01 billion in deposits during the first nine and a half hours. The company said the resulting net outflow was about $3.64 billion, representing 2.1% of the $171 billion in assets reported in its most recent proof of reserves from Oct 28.

The FBI published addresses that held or had held assets from the incident and were operated by or closely connected to TraderTraitor actors.

The FBI, Secret Service and IRS Criminal Investigation urged virtual-asset businesses to block transactions involving addresses used by the actors.

What to do now

  1. Block transactions with or derived from addresses TraderTraitor actors are using to launder the assets.
  2. Block transactions involving hundreds of Ethereum addresses, 19 Bitcoin addresses and one Solana address linked to the incident.

FAQ

What happened to Binance’s virtual assets?

The FBI said North Korea was responsible for the loss of more than $6 billion in virtual assets from Binance on or about Oct 29, 2026.

Who is behind the Binance incident?

The FBI attributed it to North Korea and refers to the activity as TraderTraitor.

How were the Binance assets moved?

The FBI observed the actors converting assets primarily into Ether and expected further laundering through DeFi and instant-swap services. Chainalysis said more than $500 million moved on Tron through more than 1,000 addresses and over 3,000 deposits.

Did the FBI identify a vulnerability or malware family?

HKCERT said the FBI alert did not identify an exploited vulnerability, a malware family or a complete technical chain.

What should crypto businesses block?

The FBI, Secret Service and IRS Criminal Investigation urged virtual-asset businesses to block transactions involving addresses used by TraderTraitor actors, including the Ethereum, Bitcoin and Solana addresses linked to the incident.

Sources

  1. FBI Confirms North Korean Hackers Responsible for $6 Billion+ Binance Attack, HKCERTPrimary
  2. North Korea Responsible for $6 Billion+ Binance Attack | Federal Bureau of Investigation, FBIPrimary
  3. Field Offices | Federal Bureau of Investigation, FBIPrimary
  4. Home Page - Internet Crime Complaint Center (IC3), IC3Primary
  5. FBI Blames North Korea for $6B Binance Hack as Exchange Reopens Withdrawals, Decrypt
How we checked this story
ClaimSourceStatus
The FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or about October 29, 2026.FBIConfirmed
The FBI refers to this North Korean malicious cyber activity as TraderTraitor.FBIConfirmed
The FBI observed TraderTraitor actors converting stolen assets primarily into Ether.FBIConfirmed
The FBI expects the stolen assets to be further laundered through DeFi and instant swap services.FBIConfirmed
The FBI published addresses that held or had held assets from the theft and were operated by or closely connected to TraderTraitor actors.FBIConfirmed
Binance estimated the financial impact at approximately $6.3 billion.Binance, via HKCERTAttributed
A compromised laptop belonging to a Binance DevOps engineer may have enabled unauthorized withdrawals, according to Binance’s initial investigation.Binance, via HKCERTAttributed
Binance later identified additional breach points, leaving the full attack path under investigation.Binance, via HKCERTAttributed
HKCERT said the FBI alert did not identify an exploited vulnerability, malware family or complete technical chain.HKCERTAttributed
The Secret Service said investigators and industry partners identified and froze a significant portion of the stolen cryptocurrency within minutes.Secret Service, via DecryptAttributed
Chainalysis said the hackers moved more than $500 million on Tron through more than 1,000 addresses and over 3,000 deposits.Chainalysis, via DecryptAttributed
Binance began restoring withdrawals in phases at 1 a.m. ET on Sunday, and all 15 networks and assets in its first phase were available by 7:36 a.m. ET.Binance, via DecryptAttributed
Binance processed $4.649 billion in withdrawals and $1.01 billion in deposits during the first nine and a half hours.Binance, via DecryptAttributed
The net outflow represented 2.1% of Binance’s $171 billion in assets.Binance, via DecryptAttributed
IC3 is the FBI-run central hub for reporting cyber-enabled crime.IC3Confirmed
HKCERT published its report on Oct 31, 2026.HKCERTConfirmed
fbi.gov published its report on Oct 31, 2026.fbi.govConfirmed
fbi.gov published its report on May 3, 2016.fbi.govConfirmed
ic3.gov published its report on Oct 23, 2026.ic3.govConfirmed

Could not verify

  • Whether the Binance theft involved an exploitable software vulnerability is not established.
  • How many Binance users or accounts were affected is not established.
  • Whether the reported laptop compromise was the initial entry point is not established.
  • Whether all stolen assets can be recovered is not established.
HKCERT
See all in AI-Powered Attacks →
Explore with AI
ChatGPT
Claude
Perplexity
Grok