FBI attributes Binance theft to TraderTraitor and urges crypto services to block transactions

An official attribution dated October 31

The FBI attributes the theft of more than $6 billion in digital assets from Binance, on or about October 29, 2026, to North Korea. In its alert published October 31 and reviewed November 1, the agency identifies this malicious activity as TraderTraitor. This is an attribution by U.S. authorities: its source and date must be retained, without presenting it as a new attack on Sunday or a court ruling.

The FBI’s figure refers to stolen assets. It is neither an estimate of funds still available at the identified addresses nor a tally of customer reimbursements. The alert does not publicly detail every element underlying the attribution. It does, however, set out an operational response: authorities are asking the private sector to help prevent further movements associated with the theft.

Observed conversions and anticipated next steps

The FBI says it is working with the USSS, the U.S. Secret Service, and IRS-CI, the Internal Revenue Service’s criminal investigation division. According to these agencies, TraderTraitor actors have converted stolen assets primarily into ether, the Ethereum network’s token. This observation does not establish that the entire reported amount is currently on a single network or held in one form. The alert provides no exhaustive financial breakdown of those conversions.

Authorities expect further laundering through decentralized-finance and instant-swap services. That expectation must be distinguished from conversions they say they have already observed. The document does not confirm that every named type of service has actually been used for all subsequent stages. Nor does it say that using ether or a decentralized protocol alone establishes the fraudulent origin of another transaction.

An address list for private operators

The appeal specifically includes THORNode and RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual-asset service providers. The FBI, USSS and IRS-CI urge them to block transactions involving addresses used to launder the stolen assets, or derived from those addresses. The published list accompanies that request. An identified address may currently hold, or previously have held, stolen assets; its inclusion therefore does not necessarily describe a current balance.

This distinction limits what can be reported about the investigation’s results. Publishing a list, identifying a movement and securing a block are different steps from seizure or restitution. The alert quantifies no newly recovered funds and promises no individual reimbursement. It asks anyone with information to contact a local FBI field office or its IC3 cybercrime reporting center. Addresses and any updates should be checked in the official document rather than reproduced as a fixed list.