FBI Confirms North Korea Behind Record $6 Billion Binance Hack and Urges DeFi to Block Stolen Funds

The Federal Bureau of Investigation has publicly confirmed what many in the crypto industry had feared since the first reports of the attack began to circulate: the theft of more than $6 billion in virtual assets from Binance was carried out by North Korea. In a statement issued on October 31, and updated later that evening, the FBI attributed the heist to TraderTraitor, a hacking group linked to the North Korean state. The incident, which took place on or about October 29, 2026, is thought to be the biggest-ever crypto heist, dwarfing previous records and sending a shockwave through exchanges, decentralised finance protocols, and regulators around the world. For an industry that has spent years hardening its defences, the scale of the loss is a sobering reminder that the most determined attackers are not opportunistic criminals working alone, but well-resourced teams operating with the backing of a state.

The North Korea Binance hack matters not only because of the size of the sum involved, but because of what it reveals about how modern crypto theft works. This was not a smash-and-grab raid on a single wallet. According to the FBI, the stolen funds have been observed moving through a complex web of addresses and conversion routes, with the attackers converting the proceeds primarily into ether, the native asset of the Ethereum network. That choice is significant. Ether is deeply liquid, widely accepted across decentralised exchanges and swapping services, and easy to move in large volumes without touching the traditional banking system. By converting into ether early, the attackers gave themselves maximum flexibility for the next stage of the operation: laundering the funds through decentralised finance and instant swap services, where transactions can be split, swapped, and re-routed at machine speed.

What the FBI actually said

The FBI statement, issued jointly with observations from the United States Secret Service and the Internal Revenue Service Criminal Investigation division, laid out the attribution in unusually direct terms. The agencies said they had observed TraderTraitor actors converting stolen funds primarily into ether and expected them to further launder the proceeds through decentralised finance and instant swap services. The statement also published a long list of addresses connected to the theft: more than 600 Ethereum addresses, just under 20 Bitcoin addresses, and one Solana address that currently hold, or at some point held, funds taken in the hack. Publishing addresses in this way is a deliberate tactic. It gives every exchange, wallet provider, analytics firm, and protocol operator a concrete blocklist to work from, and it makes it far harder for the attackers to move funds through any service that is paying attention.

Who TraderTraitor is and why the name matters

TraderTraitor is described by the FBI as a subunit of the Lazarus Group, the North Korean hacking collective that has been linked to some of the largest crypto thefts of recent years. TraderTraitor itself was previously linked to thefts from Alphapo, CoinsPaid, and Atomic Wallet in 2023, a pattern that shows a consistent focus on crypto platforms and payment processors. Understanding that lineage matters because it tells defenders what to expect. These are not attackers who strike once and disappear. They run sustained campaigns, they learn from each operation, and they reinvest stolen funds and technical knowledge into the next attack. The Lazarus Group connection also explains why governments treat these thefts as a national security issue rather than ordinary financial crime: stolen crypto has repeatedly been identified as a source of funding for the North Korean regime, which faces extensive international sanctions.

How crypto laundering through DeFi actually works

To understand why the FBI is so concerned about the laundering phase, it helps to understand how crypto laundering through DeFi typically unfolds. Once stolen funds have been converted into a liquid asset such as ether, attackers can move them through decentralised exchanges, swapping one token for another, splitting large balances across many wallets, and passing funds through cross-chain bridges and instant swap services that require little or no identity verification. Each hop makes the trail harder to follow, and automated tools can perform thousands of such hops far faster than any human analyst can track them. The goal is not necessarily to make the funds untraceable in an absolute sense — blockchains are public ledgers, after all — but to create enough complexity, speed, and jurisdictional confusion that recovery becomes impractical.

Chainalysis chief executive Jonathan Levin gave a stark sense of the scale of that challenge. He said the attackers had already used thousands of addresses and that he expected tens of thousands of addresses to be involved in the coming weeks, with the group using what he called novel automated laundering mechanisms. That prediction reframes the FBI address list in an important way. The 600-plus Ethereum addresses published so far are a starting point, not a complete picture. Defenders should expect the list to grow rapidly, and they should build systems that can ingest updated blocklists automatically rather than relying on a one-time manual review. For smaller DeFi teams, that is a real operational burden, but it is now part of the cost of operating in an ecosystem targeted by state-backed actors.

Why the FBI is asking DeFi to act

The FBI appeal to DeFi operators raises a question that goes to the heart of decentralised finance: can a system built to resist censorship also cooperate against theft? In practice, many DeFi services already have some ability to act. Front-end interfaces can block listed addresses, liquidity pools and protocols with admin controls can pause or restrict interactions, and analytics firms can flag tainted funds so that downstream services can refuse them. What the FBI is asking for is not a single switch that freezes the entire ecosystem, but a patchwork of refusals that together make laundering slow, expensive, and risky. If enough reputable services refuse to touch TraderTraitor funds, the attackers are pushed towards smaller, less liquid, and more obviously suspicious venues, where their activity is easier to spot and harder to cash out at scale.

What Binance has said and what happens to users

Binance, for its part, has moved to reassure users. The exchange said it has set aside more than $6.34 billion in company funds to cover losses from the theft. Withdrawals were suspended in the immediate aftermath of the attack, and the exchange said it was on track to resume withdrawals on November 1. That response matters for two reasons. First, it limits the direct financial damage to ordinary users, at least if the commitment holds and the funds are genuinely available. Second, it signals how the largest exchanges now think about catastrophic risk: holding a large reserve that can be deployed after an incident is treated as part of the business model, not as an afterthought. Smaller exchanges, which may not have billions in company funds to set aside, will be watching closely, because the same logic implies that a theft of this size could be existential for them.

The bigger picture for crypto security

The North Korea Binance hack will be studied for years, not only because of its size but because of what it reveals about the current state of crypto security. Attackers with state backing can marshal resources, talent, and patience that dwarf what any single company can deploy in defence. Defenders, meanwhile, are fragmented across exchanges, protocols, analytics firms, and law enforcement agencies in many countries. Closing that gap requires better information sharing, faster blocklist distribution, and a shared understanding that a theft from one major platform is a threat to the whole ecosystem, because laundered funds flow through the same infrastructure everyone uses. It also requires honesty about limits: no blocklist will catch every address, no protocol can be made perfectly safe, and some portion of stolen funds may never be recovered.

What to watch next

In the coming days and weeks, several developments will show whether the response is working. Watch for updated address lists from the FBI and from analytics firms, and for public statements from major DeFi protocols and exchanges confirming that they have blocked the listed addresses. Watch for signs that the attackers are adapting, such as a surge in new addresses or a shift towards different chains and swapping services. Watch Binance’s resumption of withdrawals and whether users report any problems, and watch for any recovery of funds, which in past large thefts has sometimes come through negotiation, seizure, or the attackers making a mistake under pressure. None of these developments alone will resolve a theft of this size, but together they will indicate whether the ecosystem’s defences are holding or being outpaced.

FAQ

What did the FBI confirm about the Binance hack?

The FBI confirmed that North Korea’s TraderTraitor hacking group was behind the theft of over $6 billion in virtual assets from Binance on or about October 29, 2026, describing it as thought to be the biggest-ever crypto heist.

Which addresses did the FBI list?

The FBI listed more than 600 Ethereum addresses, just under 20 Bitcoin addresses, and one Solana address that currently hold or at some point held funds from the hack, and urged virtual asset service providers to block transactions connected to them.

What is TraderTraitor?

TraderTraitor is a subunit of the Lazarus Group, the North Korean hacking collective previously linked to thefts from Alphapo, CoinsPaid, and Atomic Wallet in 2023.

How are the stolen funds being laundered?

According to the FBI, the attackers have converted stolen funds primarily into ether and are expected to further launder them through decentralised finance and instant swap services, using many addresses and automated techniques.

Will Binance users lose their funds?

Binance said it set aside more than $6.34 billion in company funds to cover losses, suspended withdrawals after the attack, and was on track to resume withdrawals on November 1.

Source: CoinDesk

Related reading on MM Crypto Analysis Web

• Winklevoss Backs Coin-Holder Voting for Zcash, Opposes Governance Redesign
• CFTC Chair Says Binance Breach Proves Case for Federal Exchange Option
• JPMorgan Analysts Say CLARITY Act Unlikely to Pass in 2026

More in Regulation on MM Crypto Analysis Web.