The FBI has formally blamed North Korea for the theft of more than $6 billion in crypto from Binance, naming the hacking activity it calls “TraderTraitor” and publishing 628 blockchain addresses it wants the industry to block. The alert, dated October 31, turns a theft Binance is already paying for into a laundering problem for swap services, node operators and DeFi protocols that may touch the funds next.
Binance, for its part, said early on Sunday that it had covered $6 billion of the loss with its own money.
What the FBI said
The FBI said the Democratic People’s Republic of Korea “was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.” It added: “The FBI refers to this specific North Korean malicious cyber activity as ‘TraderTraitor.'”
The bureau said it worked with the U.S. Secret Service and IRS Criminal Investigation, and that together they have “observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH).” The FBI expects the funds to be laundered further “using DeFi and instant swap services” as the attackers prepare them for later stages.
The alert does not say how the attackers got into Binance’s systems, and it does not put a more precise figure on the loss than “more than $6 billion.”
628 addresses, and who is asked to block them
The practical part of the alert is the list. The FBI said the addresses “are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors.” By AltcoinReporter’s count of the published page, the list holds 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address, 628 in total.
The bureau named the groups it wants to act. FBI, USSS and IRS-CI “are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.”
Two details stand out. First, THORNode operators are named before anyone else. THORChain was already part of this story: an Ethereum reorg on Saturday triggered an emergency pause that also stalled a laundering route used by the Binance attackers, according to Chainalysis. Second, the request covers transactions “derived from” the listed addresses, not only direct transfers. That reaches funds that have already moved one or more hops away, which is harder for a decentralized protocol or an RPC provider to screen than a single blocklist entry.
The FBI’s wording is that the agencies are “urging” these services to act. On our reading, the alert is a request rather than an order: it does not set out penalties for services that keep processing the funds, and it does not address frozen assets.
Binance says $6 billion is covered
Binance has not commented on the attribution in the posts we reviewed, but it has kept updating its repayment progress. “Update: We have already covered $6B of the impacted amount of the hacked loss,” Binance said on Sunday.
That builds on its third security incident update on Saturday. There the exchange said it had set aside “more than $6.34B in company funds to cover hacked losses” and had covered 90% of the impacted amount, drawing on part of its SAFU emergency fund, part of its futures insurance fund and its corporate treasury. “Binance will absorb the financial impact of these stolen funds, not our users,” it said. The same update said Binance remained on track to reopen withdrawals on Sunday, November 1, and would give a further update once details were confirmed. As of early Sunday UTC, Binance had not announced that withdrawals were back, and its newest posts covered only the repayment figure.
“Covered” means Binance has replaced the assets from its own balance sheet. It does not mean any of the stolen funds have been recovered. We looked at how that coverage was funded, including a 7,499 BTC SAFU transfer, in our earlier report on Binance’s 90% replenishment.
Why the attribution matters
Binance’s users are being made whole, so the attribution matters most for the money still in the attackers’ hands. An official FBI address list gives compliance teams at exchanges and analytics firms a named, government-sourced set of wallets to flag. For services that are not regulated exchanges, such as cross-chain swap networks and node providers, it puts them on notice that three U.S. agencies have asked them by name to screen these funds.
The Defiant noted that Binance kept November 1 as its withdrawal restart target even as the FBI sought blocks on the laundering trail.
What to watch next
The next signals are on-chain and operational. Watch whether THORChain node operators and large swap services publicly adopt the FBI list, whether more of the listed Ethereum addresses start moving funds, and whether exchanges announce freezes tied to these addresses. On Binance’s side, the open items are the reopening of withdrawals, the last part of its token coverage and the full zero-knowledge proof for its reserves snapshot, which it estimated would be ready by Tuesday, November 3.
FAQ
Who does the FBI say hacked Binance? North Korea. The FBI attributes the theft of more than $6 billion, on or about October 29, 2026, to North Korean activity it calls TraderTraitor.
How many addresses did the FBI publish? The alert lists 628 addresses by AltcoinReporter’s count: 608 on Ethereum, 19 on Bitcoin and one on Solana.
Are Binance users losing money? Binance says no. It said it will absorb the loss and has covered $6 billion of the impacted amount with company funds.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
