The Federal Bureau of Investigation has attributed the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance to North Korea, saying the breach took place on or about October 29, 2026. In a notice published on its website, the agency linked the attack to a North Korean group called TraderTraitor. The U.S. Secret Service and IRS Criminal Investigation are working with the FBI on the case, and investigators are already tracking how the stolen funds are moving across the market.

How the Stolen Funds Are Moving

According to the FBI, TraderTraitor actors are converting the stolen assets mainly into Ethereum. Officials expect the group to move the funds through decentralized finance (DeFi) platforms and instant swap services, steps that would prepare the assets for later stages of laundering. Instant swap services allow users to exchange one cryptocurrency for another without creating an intermediary account. The FBI and its partner agencies said they have already observed this conversion process.

The FBI, the Secret Service, and IRS Criminal Investigation have issued a call to the private sector. Specifically, they are urging THORNode operators, RPC node operators, and instant exchanges to take action. THORNodes run the node infrastructure behind cross-chain swap protocols, while RPC nodes provide the connection layer applications use to read and submit blockchain transactions. DeFi services, blockchain analytics firms, and other virtual asset service providers received the same request, and the notice is addressed to private sector entities across the virtual asset industry. Recipients are asked to block transactions with, or derived from, addresses used by TraderTraitor.

The FBI also published a full list of addresses that hold or have held assets from the Binance hack, all of which are operated by, or closely connected to, the North Korean actors. Because transfers between on-chain addresses are recorded on public ledgers, service providers and analytics firms can screen activity against such a list and block transactions tied to the flagged addresses. The complete list appears in the FBI notice for reference.

The announcement was publicized through the FBI Cyber Branch's official account on X:

The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North…

— FBI Cyber Branch (@FBICyberBranch) October 31, 2026

Anyone with information about the incident is asked to contact a local FBI field office. The Internet Crime Complaint Center also accepts reports through ic3.gov. The FBI said it remains committed to disrupting North Korea's illicit cybercrime and asset theft activities, and it encouraged the virtual asset community to share relevant information.

Binance Covers Losses and Resumes Withdrawals

Binance moved quickly after the hack to cover the losses using $6.34 billion drawn from its own funds. The exchange fully backed major assets such as Bitcoin and Ethereum, and it also acquired less liquid tokens during the process. Less liquid tokens are assets that are harder to sell quickly in the market. Binance is absorbing all costs related to the incident, which means the company, rather than its users, is carrying the financial burden.

Withdrawals began resuming in phases on November 1. In an update posted on X, the exchange confirmed which networks and assets had been re-enabled:

Latest Withdrawal Update

Withdrawals have now been re-enabled for the following networks and assets:

• BTC: BTC
• ETH: ETH, USDT, USDC
• BSC: BNB, USDT, USDC
• XRP: XRP
• Base: ETH, USDC

We will continue to restore additional assets and networks in phases as security…

— Binance (@binance) November 1, 2026

Binance also plans to complete a full proof of reserves by November 3. A proof of reserves is intended to demonstrate that customer holdings are fully backed by the exchange's own reserves. The step follows the company's move to fully back major assets, and the timeline places the reserve review two days after withdrawals began resuming.

Washington Response

President Donald Trump said he is not concerned about the Binance hack and added that he plans to talk to North Korea about the incident. The remarks followed the FBI's attribution of the theft to a North Korean group.

This article is based on reporting by Blockonomi.