The FBI said Saturday that North Korea was responsible for the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance, stolen in an attack on or about October 29, 2026. The agency published the finding in a news release, which also lists the blockchain addresses tied to the stolen funds.

The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North… pic.twitter.com/TBUvUFln4n

— FBI Cyber Branch (@FBICyberBranch) October 31, 2026

https://x.com/FBICyberBranch/status/2116660730745299426?ref_src=twsrc%5Etfw

Binance was hacked on Thursday. Some reports have put the loss at $6.4 billion, and several blockchain analytics firms linked the attack to North Korea shortly after the incident came to light. The FBI's disclosure confirms those preliminary assessments.

What the FBI Said About the Binance Hack

The FBI attributes the breach to a group it calls TraderTraitor, a subunit of the Lazarus Group, which has carried out previous cryptocurrency exchange hacks. According to the agency, the hackers have so far converted most of the stolen funds into Ether, and it expects them to turn to DeFi tools and instant swap services next as they attempt to launder the money. At this size, the loss would rank among the largest single thefts attributed to the Lazarus Group's crypto operations.

The FBI, the U.S. Secret Service and IRS Criminal Investigation asked private-sector companies to assist with the response. They urged THORNode operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to block transactions involving the stolen assets.

The notice lists more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address, with the full list posted in the news release. Stablecoin issuers have frozen more than $2.4 billion of the stolen funds, while the attackers have continued laundering much of the remainder. With the notice public, any additional freezes beyond the $2.4 billion already immobilized will track how broadly the private-sector response is heeded.

Chainalysis Tracks a Growing Laundering Network

Chainalysis said the attackers have already used thousands of addresses, and CEO Jonathan Levin expects that number to grow to tens of thousands in the coming weeks. Levin said the hackers are holding more money than their trusted laundering venues can handle, meaning the funds will move to bridges, instant exchanges and swappers.

The analytics firm also reported that the attackers are deploying novel automated laundering mechanisms. According to its blog post, the tools shuttle funds between addresses to obscure the trail. Even as the trail fragments across more venues, each hop leaves a public on-chain record that investigators and compliance teams can trace.

North Korea's Record of Crypto Theft

North Korea has a long record of stealing digital assets. CertiK reported that groups tied to the country stole more than $2 billion of the $3.4 billion in crypto losses recorded in 2025, and Cointelegraph reported that North Korean hackers accounted for roughly 60% of the value lost to hacks that year. The proceeds are used to help fund the country's nuclear and ballistic missile programs.

CertiK estimates that North Korea-linked actors stole about $6.75 billion across 263 incidents between 2016 and early 2026. Its analysis concluded that the country has turned crypto theft into a core source of state revenue. MilitarySpend estimates North Korea's yearly defense spending at up to $6 billion, though that figure is uncertain, and says crypto theft adds off-budget financing for weapons programs. A single breach of this size would rival that cumulative multi-year total.

Binance Replenishes Funds as Washington Responds

Binance said Saturday that it had replenished 90% of the stolen cryptocurrencies and plans to resume customer withdrawals on Sunday.

President Donald Trump was asked about the hack on Saturday. "We're learning about it," he said, adding that his administration would talk to North Korea about the incident. From here, the markers to watch are whether withdrawals resume on schedule, whether more of the funds are intercepted as the address count climbs, and how the administration's planned talks with Pyongyang unfold.