The FBI Binance hack investigation reached a turning point on Saturday, October 31, 2026, when the Federal Bureau of Investigation formally blamed North Korea for the theft of more than $6 billion in virtual assets from Binance, the world's largest cryptocurrency exchange. The announcement is the first official confirmation by the United States government that Pyongyang's hackers carried out the biggest crypto heist in history, an attack that drained about $6.3 billion from Binance within minutes on Thursday, October 29.

Key Points

• The FBI said in a cyber alert on October 31 that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance, on or about October 29, 2026.
• The bureau tied the attack to TraderTraitor, the North Korean hacking operation previously blamed for the $1.5 billion Bybit hack in 2025.
• Working with the US Secret Service and IRS Criminal Investigation, the FBI said TraderTraitor actors are converting the stolen assets primarily into Ethereum.
• The FBI warned the funds are expected to be laundered further through decentralised finance platforms and instant swap services, and urged exchanges to block linked addresses.
• Binance said on October 31 that it has covered about 90 percent of the $6.3 billion and will absorb the full impact, so users will not suffer losses, with withdrawals targeted to resume on November 1.

What Happened

On Thursday, October 29, about $6.3 billion in bitcoin and other digital currency was stolen from Binance in what several crypto experts immediately said bore the hallmarks of a North Korean hack. Blockchain analytics firm TRM Labs estimated the haul at approximately $6.36 billion across multiple blockchain networks operated by Binance, with most of the funds drained within roughly 20 minutes. The scale makes it the largest known hack of a digital asset exchange on record, more than four times the size of the Bybit incident.

The FBI's statement on Saturday turned that private-sector assessment into an official United States position. "The FBI is releasing information advising the Democratic People's Republic of Korea was responsible for the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026," the agency said in its cyber alert, referring to North Korea by its official name. The bureau said the attack was tied to "malicious cyber activity" by TraderTraitor, and it released addresses linked to the theft so that the money could be tracked and blocked.

"The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum," the FBI said, referring to the US Secret Service and the criminal division of the Internal Revenue Service. "It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages." The bureau asked crypto exchanges, blockchain analytics companies and others to block transactions linked to the identified addresses to make sure the money is not laundered to cover up its origins.

Background/Context

North Korean hackers are well known for past attacks against crypto exchanges, and United States officials and cybersecurity experts have accused them of some of the biggest crypto heists in recent years. TraderTraitor is an elite North Korean hacking unit that the FBI previously blamed for the Bybit hack in February 2025, in which approximately $1.5 billion worth of Ethereum was stolen. The group has also been linked to a 2022 theft of about $620 million in cryptocurrency. The Binance theft dwarfs both.

Before the FBI's announcement, attribution rested on private firms. TRM Labs identified TraderTraitor as the perpetrator, and Chainalysis expressed a "high degree of confidence" in North Korea's involvement. Binance itself had not named North Korea, and its co-chief executive Richard Teng had said the company's investigation had not attributed responsibility to any individual. That changed with the FBI alert, which follows the pattern of earlier cases in which Washington publicly names North Korean cyber operations after its own investigators confirm the private-sector findings.

The political backdrop adds weight to the announcement. President Donald Trump said on October 30 in the Oval Office that the United States was looking into whether North Korea was involved in the Binance attack. "They're saying they're guaranteeing it or something," Trump told reporters. "It was a hack. That's the problem. You know the old-fashioned way when you used to sign a check, take it out. These are different people. Never see the money anymore. So I've always felt it was a little bit dangerous." Trump has in recent weeks floated new outreach to North Korea, suggesting a potential meeting with its leader, Kim Jong Un, could happen in 2026, though earlier in October he downplayed those expectations.

The FBI Binance Hack Attribution: What the Alert Says

The FBI Binance hack attribution matters because it converts a widely shared suspicion into an enforcement action. By naming TraderTraitor in a formal alert and publishing linked addresses, the bureau gives every exchange, node operator, instant exchange and decentralised finance service a concrete basis to refuse the stolen funds. The alert was issued jointly in effect with the Secret Service and IRS Criminal Investigation, the two partners the FBI named, signalling that the recovery effort spans both the financial-crime and tax-enforcement arms of the federal government.

The laundering warning is the most urgent part of the alert. Converting the haul primarily into Ethereum is, in the FBI's account, only the first step: the bureau expects TraderTraitor to push the assets through decentralised finance platforms and instant swap services, tools designed to move value quickly between chains and tokens without a central intermediary. That is why the bureau's message to the industry is framed as a blocking request rather than a simple notice. If the addresses are frozen wherever they surface, the hackers' ability to cash out narrows with every hop.

Binance's own account of the breach, reported by the New York Post, points to several "points of breach" detected after the hack, including one software engineer's laptop, in an attack that took roughly 20 minutes to execute. The Post also reported that investigators believe the hackers likely leveraged artificial intelligence to exploit previously unknown security flaws in the exchange. Binance has said no wallet private key leak was found in earlier reporting, and the company has emphasised that its own funds, not customer deposits, will cover the loss.

Reactions/Quotes

Binance moved on Saturday to reassure its users alongside the FBI announcement. The company said it had set aside more than $6.34 billion in company funds to cover the hacked losses and had already made 90 percent of the losses whole. "Binance will absorb the financial impact of these stolen funds, not our users," the company said in an update on Saturday. Binance also said the most popular cryptocurrencies on its platform, including Bitcoin, Ethereum, Binance Coin, Solana, XRP and Zcash, are "fully backed 100 percent," and it published snapshots of its Proof of Reserve along with links to its Secure Asset Fund for Users and its Futures insurance fund.

Co-chief executive Richard Teng reassured users that the 90 percent already covered came from company reserves, so regular customers are not losing money. Withdrawals were paused for safety after the attack but were set to reopen on November 1, subject to security checks, and Binance said it had already frozen about $3 billion on-chain with the help of blockchain partners. The company also said it would allocate 50 percent of the funds in its Secure Asset Fund for Users to cover losses from the hack, while keeping the remaining half in the fund.

The FBI's message to the wider crypto industry was blunt: block the linked transactions. The bureau asked exchanges, analytics firms, node operators and decentralised services to refuse transfers tied to the published addresses, warning that further movement of the funds is expected. That appeal puts smaller platforms and instant swap services on the spot, since TraderTraitor's expected route runs precisely through services built for speed and minimal friction.

Why It Matters

This is the largest cryptocurrency theft ever recorded, and the first time Washington has formally blamed North Korea for it. The attribution raises the stakes beyond a single company's security failure: United States officials have long argued that North Korea's cyber thefts fund its weapons programmes, and a $6.3 billion haul, even partially frozen, would be by far the regime's biggest crypto payday. The FBI alert therefore doubles as a sanctions and deterrence signal, telling banks, exchanges and software providers worldwide that handling these funds risks United States enforcement action.

For ordinary crypto users, the episode is a stress test of the industry's promise that exchanges can make customers whole after a catastrophic breach. Binance's claim that 90 percent is already covered, backed by company funds and its SAFU and insurance reserves, will be judged against what actually happens when withdrawals resume. If users can withdraw in full and on time, Binance will have contained a record loss; if the remaining 10 percent, held in less liquid tokens, takes much longer to source, confidence in even the largest exchanges will take a further hit.

The case also matters for how fast attribution now happens. Within about 48 hours of the theft, private firms had named TraderTraitor, the president had commented, and the FBI had confirmed it. That speed reflects how much blockchain forensics has matured: stolen funds leave a public trail across chains, and firms such as TRM Labs and Chainalysis can follow it in near real time. It also shows the limits of that transparency, because tracing is not the same as recovering, and the FBI's own warning concedes that the laundering stages are still ahead.

What Happens Next

The immediate test is November 1, Binance's target for restoring withdrawals. The exchange has said the restart is subject to security checks, and any delay or partial resumption will be read as a signal about how much of the damage is truly repaired. At the same time, the industry-wide blocking effort will be tested as TraderTraitor attempts the DeFi and instant-swap conversions the FBI predicted; each blocked transfer is a small win, and each successful hop makes recovery harder.

Investigators will also keep working the breach itself. Questions remain about how the attackers reached Binance's systems, which of the reported breach points mattered most, and whether the artificial-intelligence angle reported by the New York Post is confirmed by the official investigation. Further FBI updates, additional address publications and possible sanctions designations are the usual next steps in a North Korea cyber case, and any of them would extend this story.

Diplomatically, the attribution lands awkwardly against Trump's talk of a possible 2026 meeting with Kim Jong Un. A formal accusation that Pyongyang stole $6.3 billion from the world's largest crypto exchange is not the backdrop for a friendly summit, and Washington's next moves, whether further sanctions or a law-enforcement action, will show whether the outreach survives the hack.

Frequently Asked Questions

What did the FBI say about the Binance hack?

The FBI said on October 31 that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026, tying the attack to the TraderTraitor hacking operation.

How much was stolen from Binance?

About $6.3 billion was stolen, according to Binance and blockchain analysts. TRM Labs put the figure at approximately $6.36 billion, most of it drained within roughly 20 minutes, making it the largest crypto exchange hack on record.

Who is TraderTraitor?

TraderTraitor is an elite North Korean hacking unit that the FBI previously blamed for the $1.5 billion Bybit hack in 2025 and that has been linked to other major crypto thefts, including a roughly $620 million theft in 2022.

Will Binance users lose money?

Binance says no. The company said it has covered about 90 percent of the losses from its own funds and will absorb the full financial impact, with withdrawals targeted to resume on November 1, 2026.

What happens to the stolen funds now?

The FBI says TraderTraitor is converting the assets primarily into Ethereum and is expected to launder them further through DeFi platforms and instant swap services. The bureau has asked exchanges and crypto services to block transactions linked to the published addresses.

Related coverage: Binance Covers 90% of $6.3 Billion Hack Losses as Withdrawals Resume Today and Binance North Korea Hack Blamed for $6 Billion Heist as FBI Joins Recovery.