FBI attributes a theft of more than $6 billion from Binance to North Korea
The FBI dates the virtual-asset theft to around October 29 and links it to TraderTraitor. Its alert calls on operators able to trace or block the funds to act.
Going deeper
Generated image · SecuFocus
At a glance
Key points
The FBI attributes the theft of more than $6 billion in virtual assets from Binance to North Korea, dating the incident to around October 29, 2026. It refers to the activity as TraderTraitor and asks industry operators to disrupt laundering. This is an agency attribution, not an independent SecuFocus finding or proof that every customer’s credentials were stolen.
What the agency says
The FBI alert describes more than $6 billion stolen from cryptocurrency exchange Binance around October 29. It attributes the activity to North Korea under the name TraderTraitor. We retain the threshold in that source rather than substitute a more precise amount from press coverage.
Together with the USSS and IRS-CI, the FBI says it has observed stolen assets being converted primarily into Ether. It expects further laundering through decentralised-finance and instant-swap services. An observed conversion and an expected next step are different findings.
The request primarily addresses infrastructure operators
The agency calls on node operators, exchanges, decentralised-finance services and analytics providers to block transactions linked to addresses in its alert. Those indicators are for tracing funds, not destinations to which a customer should send money.
We link to the official list instead of copying a set that could become outdated. A linked address or transaction alone does not reconstruct the total losses, every recipient or the complete laundering chain.
An investigation is not an unsolicited recovery offer
For a customer, this announcement does not establish that their password, API keys or all personal holdings were exposed. Check notifications and account activity through the official app or website, not a link supplied by someone claiming to recover the funds.
A request for a recovery phrase, private key or advance payment does not become legitimate by citing the alert. The FBI provides its own reporting channels; the notice does not promise a refund or recovery for every person. This article is not investment advice.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.