Markets · Exchanges
The FBI says North Korea's TraderTraitor hackers took more than $6 billion from Binance and are converting it mostly into ether. It published hundreds of addresses and asked crypto services to block them.
Update, 11:04 p.m. EDT Oct. 31: Binance said in a post on X: "Update: We have already covered $6B of the impacted amount of the hacked loss." [6] Coverage is Binance's own measure. It is not a recovery of the funds the FBI says were taken.
Update, 8:14 p.m. ET Oct. 31: The @RapidResponse47 account said in a post on X: ".@POTUS on the Binance hack: "We're learning about it. We don't know if it's North Korea — but if it is, we'll talk to North Korea about it."" [5] The post does not mention the FBI's alert, which says North Korea was responsible [1].
The FBI said Saturday that North Korea was behind the attack on Binance. In a cyber alert dated Oct. 31, the bureau said the country "was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026" [1]. It gave the activity a name, "TraderTraitor," and published the addresses it says the attackers are using.
The stakes are straightforward. A private firm's attribution is now the U.S. government's. The government's alert also comes with a specific request to the services that sit between the taken coins and spendable money: stop handling them.
This follows Le Coin's report on Chainalysis's attribution on Friday, when the blockchain analytics firm named the same group [2]. The North Korea attribution in this piece is the FBI's. Le Coin has not independently assessed it.
The FBI describes a familiar sequence. Its alert says the FBI, "together with partners at the USSS and IRS-CI," the U.S. Secret Service and the IRS's criminal investigation unit, "has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH)" [1].
Conversion is the first step, not the last. "It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages," the alert says [1]. DeFi refers to trading services run by software on a blockchain rather than by a company. Instant swap services exchange one coin for another quickly, often with little or no account checking. Each hop puts more distance between the original attack and the coins that come out the other end.
That is why the alert is aimed at those services, and not only at the attackers. The FBI, USSS and IRS-CI "are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets" [1]. RPC node operators run the servers that apps use to read and send blockchain transactions. The FBI does not describe the other services it names, and we do not add to its list.
The core of the alert is a list. The FBI says the addresses "are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors" [1].
| Chain | Addresses listed |
|---|---|
| Ethereum (ETH) | 608 |
| Bitcoin (BTC) | 19 |
| Solana (SOL) | 1 |
| Total | 628 |
Source: FBI alert, Oct. 31 [1]. Counts are Le Coin's, from the page as fetched at 6:03 p.m. ET. Every Ethereum address on the page is unique.
The weighting matches the FBI's description. More than 95% of the listed addresses are on Ethereum, by Le Coin's arithmetic, which fits the alert's statement that the assets were converted "primarily" into ether [1]. The FBI does not say how much is held at each address or in total.
The FBI's number sits alongside two others already on the record. None of the three was produced by the same method, and we have not tried to reconcile them.
| Source | Amount | Attribution |
|---|---|---|
| FBI, Oct. 31 alert | "more than $6 billion USD" | North Korea, "TraderTraitor" |
| Chainalysis, Oct. 30 | "approximately $6.4 billion USD" in transfers | North Korean group TraderTraitor |
| Binance, Oct. 30 | "approximately $6.3B USD worth of token assets" | None given |
Sources: FBI [1]; Chainalysis blog post, Oct. 30 [2]; Binance Update #2, Oct. 30 [3].
The alert also gives a date, "on or about October 29, 2026," and a reporting route: local FBI field offices or the bureau's Internet Crime Complaint Center at ic3.gov [1]. The bureau frames the alert as part of a standing effort. It says it "maintains its commitment to protecting the virtual asset community by identifying, mitigating, and disrupting North Korea's illicit cybercrime and virtual asset theft activities" [1]. The alert does not describe how the FBI reached its attribution, and it does not cite Chainalysis or any other private firm.
An attribution is not a recovery. The FBI alert does not say any funds have been seized or frozen, and it does not give the size of the remaining balances. Binance has said it will cover users' losses itself [4], which is a separate question from getting the coins back.
A block request also only works where it is honored. The FBI asks private services to act. It does not, in this alert, order them to. Services that do not screen addresses, and software that no one operates, are outside its reach. The list is also a snapshot. The FBI describes the addresses as ones that "are holding or have held" assets from the theft, which means some may already be empty [1].
In Le Coin's view, the signal to watch is whether the named service types act in public. If node operators, swap services or analytics firms say they have added the FBI's 608 Ethereum addresses to their block lists, the alert will have teeth. A follow-up FBI list with new addresses would show the funds are still moving. A seizure announcement would be the first sign of the money coming back.
The FBI says North Korea's TraderTraitor took more than $6 billion from Binance on or about Oct. 29 and is converting it mostly into ether. It has published 608 Ethereum, 19 bitcoin and 1 Solana address and asked service providers to block them.
Holding the Corner.
Not financial advice.