FBI Blames North Korea for Binance Theft

Developing as of Oct. 31, 2026. Binance’s withdrawals and reserve report are still ahead.

The FBI said Saturday that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance, two days after the largest crypto theft on record. That is a far faster public attribution than the bureau gave in most of the big North Korean thefts before it.

The bureau tied the theft to activity it tracks as TraderTraitor, the same label it used for the $1.5 billion Bybit theft in February 2025. It said it expects “further laundering stages,” Reuters reported, and that the thieves had been converting the stolen assets into ether. According to crypto outlets that read the alert, the FBI, Secret Service and IRS Criminal Investigation asked node operators, instant exchanges, DeFi services and other providers to block transactions tied to a list of published addresses. We could not load the alert itself.

From a private call to a government one in two days

Blockchain firm TRM Labs moved first, posting late Thursday that it judged the attack to be TraderTraitor’s work “with high confidence.” Chainalysis reached the same conclusion, citing stolen funds that mingled on-chain with last month’s Bitget theft. On Friday President Trump, asked about North Korea at the White House, said, “We’re looking at that.” Binance co-CEO Richard Teng wrote on X that the company’s own investigation had not attributed responsibility to any individual. North Korea routinely denies involvement in hacking, Al Jazeera noted.

The table shows how long the FBI’s public attribution took in five of the largest cases. The gaps are our count from the dates reported.

Speed matters here because of how the money moves. Tether and Circle can freeze their own stablecoins, and much of the frozen total came that way. Ether has no issuer to call. Chainalysis says the attacker swapped $325 million in stablecoins into $285 million of ether in nearly 20 minutes to stay ahead of the freezes.

Twenty minutes and a disputed entry point

TRM says about $6.36 billion left Binance wallets on 10 blockchains, most of it in about 20 minutes. Chainalysis puts the total near $6.4 billion, and Binance says about $6.3 billion and warned that the number could rise. The firms also differ on the start, about 4:05 p.m. Eastern by TRM’s count against about 4:20 p.m. by Chainalysis’s.

Binance first pointed to a compromised DevOps engineer’s laptop, then said it had found additional points of breach. Teng said in a Friday video that the attacker used an EIP-7702 delegation, an Ethereum feature that lets ordinary wallets run smart contract code, which he said “did not pass through our normal approval controls.” He also described a self-destruct mechanism that wiped tools and traces. Binance says it has found no evidence that a private key leaked, but Mark Karpeles, the former head of Mt. Gox, told Reuters the attackers had probably accessed keys for at least two wallets.

The freeze figures vary too. Binance says about $3 billion, including more than $2.3 billion from Tether and Circle according to Reuters, while Chainalysis says about $2.8 billion. Binance has not said what became of the rest.

Covered is a different word from recovered

Binance said Saturday that it had restored backing for about 90% of the stolen tokens, up from 80% a day earlier, drawing on its Secure Asset Fund for Users, part of its futures insurance fund and its corporate treasury. CNBC stressed the distinction. That money is Binance’s own, and it does not mean 90% has come back from the thieves. The remaining 10% is tokens outside its top 10 that take longer to buy.

Those claims are not yet independently checked. CertiK told Cointelegraph on Friday that it needed more information to verify Binance’s claimed $5 billion in replacement crypto. Binance has published a reserves snapshot and says a full cryptographic proof takes 40 to 50 hours to generate.

A sanctioned intelligence bureau on the other end

The U.S. record on who sits behind the name goes back further than this week. In 2019, Treasury sanctioned Lazarus Group, Bluenoroff and Andariel, saying all three are controlled by the Reconnaissance General Bureau, North Korea’s primary intelligence bureau. TraderTraitor is the FBI’s name for one strand of that activity, also tracked as Jade Sleet, UNC4899 and Slow Pisces, according to the FBI’s DMM alert.

The sums have changed since then. In December 2022, South Korea’s spy agency estimated that North Korean hackers had stolen about $1.1 billion in crypto and other virtual assets over five years. This one theft is more than five times that. TRM counted $2.87 billion stolen by all hackers worldwide in nearly 150 attacks in 2025.

Some of the laundering stalled on Saturday by accident. Chainalysis said on X that a block reorganization caused THORChain to issue a double refund, triggering an emergency pause that also blocked the launderers’ cross-chain swaps until service returns.

Binance says withdrawals will begin resuming in phases Sunday, subject to security checks, with its proof-of-reserves report due Monday.

Sources:

• FBI alert on the Binance theft (Oct. 31; link as cited by other outlets, not read directly)
• Reuters via Yahoo, the FBI attribution (Oct. 31)
• Coindoo, the FBI’s request to providers and Chainalysis’s THORChain post
• TechFlow, the three agencies’ request
• Associated Press via PBS, TRM, Trump, South Korea’s estimate
• Al Jazeera, totals, freezes, Teng, Karpeles
• Chainalysis, on-chain findings
• Decrypt, Teng’s video transcript
• CNBC, the 90% figure and the laptop statement (Oct. 31)
• Cointelegraph, the funding sources and CertiK (Oct. 31)
• CoinCentral, the timeline
• FBI, Bybit public service announcement (Feb. 26, 2025)
• The Record, the DMM attribution
• Security Affairs, quoting the FBI’s DMM alert
• BleepingComputer, the Ronin attribution
• TechRadar, the Harmony attribution (Jan. 24, 2023)
• U.S. Treasury, 2019 sanctions on Lazarus Group