North Korea’s $6.3B Binance Heist Has a “TraderTraitor” Problem 🕵️

The FBI attributed the theft of about $6.3 billion in digital assets from Binance to North Korea, confirming blockchain analytics firms TRM Labs and Chainalysis’ identification of the country’s “TraderTraitor” hackers. The FBI said the attack occurred on or about October 29, 2026, and warned that the stolen assets were being converted mainly into Ethereum ($ETH) before further laundering through decentralized finance and instant swap services.

In an alert published on October 31, 2026, the FBI urged THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other digital asset service providers to block transactions involving or derived from TraderTraitor addresses. The bureau released a full list of linked addresses covering hundreds of Ethereum addresses, 19 Bitcoin ($BTC) addresses and one Solana address. The Secret Service and IRS Criminal Investigation also participated in the investigation.

Blockchain analytics firm Chainalysis reported that the hackers had moved more than $500 million on Tron through more than 1,000 addresses, over 3,000 deposits and several Tron-based DeFi protocols. Most of those staging wallets were subsequently drained, with funds moving through cross-chain services including Chainflip, Relay, THORChain and NEAR into fresh wallets on Ethereum, Bitcoin and other chains before the launderers advanced to Solana.

The Secret Service said its investigators worked with industry partners to identify and freeze “a significant portion” of the stolen cryptocurrency within minutes of the attack. That work continued with the FBI, IRS Criminal Investigation, the U.S. Attorney’s Offices for Washington, D.C. and the Central District of California, and the Justice Department’s computer crime and national security divisions.

Binance resumed withdrawals in phases at 1 a.m. ET on Sunday, with all 15 networks and assets in its first phase available by 7:36 a.m. ET. During the first nine and a half hours, the exchange processed $4.649 billion in withdrawals and $1.01 billion in deposits, producing a net outflow of about $3.64 billion. That represented 2.1% of the $171 billion in assets Binance reported in its most recent proof of reserves from October 28. “After an initial spike, withdrawal volumes have declined and are stabilising as expected,” Binance said, adding that it had taken a new reserves snapshot on October 31 and expected to publish an updated report on Monday.