FBI Formally Blames North Korea for $6 Billion Binance Theft, Says Hackers Are Converting Loot to Ethereum

Since hackers drained Binance's wallets on Oct. 29, private blockchain analysts have pointed at North Korea. Today, Oct. 31, the U.S. government said it too.

In a cyber alert, the FBI said North Korea "was responsible for the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026." The agency named the operation "TraderTraitor," a label previously tied to North Korean crypto thefts. It used the country's official name, the Democratic People's Republic of Korea.

What the FBI says is happening to the money

The FBI said it has watched the hackers convert the stolen assets primarily into Ethereum. It is working on this with the U.S. Secret Service and the IRS Criminal Investigation division.

The agency expects the next step to be more laundering through decentralized finance platforms and through exchange services that let users swap one digital asset for another quickly.

The FBI, Secret Service and IRS asked exchanges, blockchain operators, analytics firms and other virtual asset service providers to block transactions involving wallet addresses the hackers are using to launder the funds.

That is a request, not a mandate. The alert does not say which companies have complied.

Where the stolen money stands

TRM Labs says about $6.36 billion left Binance wallets across ten blockchains, with most of it moving in roughly 20 minutes beginning around 8 p.m. ET Thursday. Ethereum made up the largest share, followed by Bitcoin, Tron, the XRP Ledger and Solana.

Binance puts the verified frozen total at around $3 billion. TRM calculates that stablecoin issuers and the Arbitrum Security Council froze nearly $2.7 billion of it. Changpeng Zhao, Binance's founder, who says he no longer manages the exchange, credited Tether with freezing about $971 million and Circle about $823 million.

The harder problem is what remains. TRM estimates the attacker still controls about $2.4 billion in assets with no central issuer able to freeze them. Those can be moved and swapped across a large web of addresses.

An analyst at Singapore-based Pangolin Intelligence, who asked not to be named, told CNN the "cat and mouse game has barely begun yet." The analyst said North Korea is likely to tap a network of money laundering organizations to cash out.

How the breach happened

Binance has said an engineer's laptop was compromised, giving an attacker access to a service container from which unauthorized withdrawals were submitted. The company later said there were "additional points of breach."

Co-CEO Richard Teng has said it was not a "one-click" attack on a single employee but a more complex process. Binance has said its investigation has not attributed responsibility to any individual and has found no evidence of a wallet private key leak.

TRM says the hackers began staging at least 36 hours before the theft, using small Tornado Cash withdrawals to fund an operator wallet. It says that pattern matches earlier North Korea-linked heists, including Bybit and the KelpDAO hack in April 2026.

Pyongyang's position

North Korea has previously denied hacking allegations. CNN said it asked North Korea's mission at the United Nations for comment on the Binance attribution. No response has been reported.

The FBI's alert is the government's own finding, and it follows the earlier assessments from TRM Labs, Chainalysis and Elliptic. The agency has not published the evidence behind it in the alert as described.

What Binance owes its customers

Binance says it will cover all customer losses and has set aside $6.34 billion. Teng said, "your money is safe, and we're covering every loss." The exchange had about $162.8 billion in assets under custody as of its 2025 annual report and says it has 335 million registered users.

Deposits and withdrawals remain suspended. Binance said they are expected to resume Sunday morning, Nov. 1.

The Secret Service has said it is working with federal prosecutors to identify those responsible. No charges have been announced.

The open question is the $2.4 billion TRM says nobody can freeze. Whether exchanges act on the FBI's block request before that money is swapped and scattered will decide how much of it is ever recovered.