FBI links Binance’s $6.3bn theft to North Korea

The FBI on October 31 attributed the theft of more than $6 billion from Binance to North Korea’s TraderTraitor hacking operation, and urged crypto services to block transactions linked to the stolen funds. In its public alert, the bureau said the theft occurred on or about October 29 and that the group was converting assets primarily into Ether. Binance has put the loss at about $6.3 billion, according to the Associated Press. If confirmed at that scale, it would exceed the $1.5 billion Bybit theft in February 2025, which the FBI also attributed to TraderTraitor.

What did the FBI ask crypto services to do?

The FBI, alongside the U.S. Secret Service and IRS Criminal Investigation, asked exchanges, decentralized finance services, instant swap providers and other virtual asset businesses to block transactions from or connected to listed wallet addresses. The alert includes addresses that the FBI says hold, or previously held, assets from the theft and are operated by or closely connected to TraderTraitor.

The FBI said it expects the stolen assets to move through DeFi and instant swap services as laundering continues. That creates a specific response for intermediaries: identify the listed wallets and stop transactions when they encounter them. CoinDesk reported that the FBI published hundreds of addresses across Ethereum, Bitcoin and Solana. The list can help services screen activity, but it does not freeze crypto across a network by itself; each service must act when a transaction reaches it.

How does this compare with the Bybit theft?

The Binance loss is more than four times the amount stolen from Bybit, the previous record cited in recent coverage. Both incidents have been attributed to TraderTraitor, but the public information available so far does not establish that the attacks used the same method. The FBI’s alert describes how funds are moving after the Binance theft, not the entry point or a complete account of how the breach occurred.

The difference in scale raises the stakes for tracing and recovery. The FBI says the attackers are converting assets mainly into Ether, then may use swaps and DeFi services to obscure their movement. Some crypto businesses can block transactions connected to known addresses; other assets cannot be frozen by a central issuer in the same way. That makes the composition of the remaining funds and their path through intermediaries relevant to how much can be stopped or recovered.

What remains disputed, and what should readers watch?

North Korea has denied responsibility. In reporting published November 3, CoinDesk said Kim Yo Jong called the U.S. accusation a political provocation. Blockchain analytics firm Elliptic told CoinDesk its on-chain analysis supported the FBI’s attribution, and said $2.85 billion had been frozen or seized. The FBI has not publicly released its full forensic findings, CoinDesk reported, so the official attribution and the denial remain competing claims, with investigators’ wallet tracing providing evidence that can be assessed over time.

The next signals are whether exchanges and DeFi services block more of the identified flows, how much of the stolen crypto remains movable, and whether investigators publish further evidence about the breach and attribution. The comparison with Bybit is also a test of whether the same laundering routes recur. Tracking those movements may clarify what can be disrupted; it will not, by itself, establish how much of the loss customers ultimately recover.

Source material

• public alert — fbi.gov