The FBI said on Saturday, October 31, that North Korea took more than $6 billion in virtual assets from Binance during the October 29 theft, per the bureau's cyber alert. The bureau named the operation TraderTraitor, a label already attached to earlier thefts tied to Pyongyang's hackers. The statement turns a suspicion that circulated since Thursday into an official US government attribution, and it arrived with a warning that the stolen funds are already on the move.
That warning is the part exchanges have to act on first. A blocklist only works if venues apply it before the next swap.
Working with the US Secret Service and the IRS criminal investigation division, the FBI said it had seen TraderTraitor members shifting the stolen coins chiefly into ether. The bureau expects the actors to push the funds through decentralized finance platforms and instant swap services next, which swap coins with little friction. To slow that down, the three agencies urged crypto platforms, analytics firms, node operators and swap services to refuse any transfer tied to the addresses the hackers are using. The alert includes a long list of ether wallets that the FBI links to the theft.
The attribution did not come out of nowhere. Blockchain intelligence firm TRM Labs had earlier blamed TraderTraitor for the theft, which it estimated at $6.36 billion, per Yonhap. The FBI's statement follows that assessment and puts the US government's name on it. The same TraderTraitor label was previously attached by the FBI to the $1.5 billion Bybit theft of February 2025, per the Straits Times, and North Korean hackers have also been accused of the 2022 theft of about $620 million in crypto. The FBI alert answers that question directly.
Why it matters
Attribution changes the shape of the incident for everyone except Binance's customers. For Binance, the money question was largely settled on Saturday, when the exchange said it had covered about 90% of the $6.3 billion and planned to restore withdrawals by November 1, per the Straits Times. For the rest of the industry, the open question is the remaining flow of stolen coins, and the FBI's address list gives compliance teams a concrete checklist instead of a vague threat. Conversion into ether concentrates the trail on one chain for now, but every swap through a DeFi pool splits it again. The race is between blocklists spreading across venues and the hackers reaching services that never check them. Readers tracking the recovery side can compare this with Binance replenishes 90% of stolen crypto, targets Sunday withdrawal restart, and the industry response covered in Coinbase, Kraken and OKX tighten defenses after $6.3B Binance heist.
| Incident ledger | Figure |
|---|---|
| Theft from Binance, October 29 | More than $6 billion, per FBI |
| TRM Labs estimate of the theft | $6.36 billion |
| Binance coverage reported October 31 | About 90% of $6.3 billion |
| Computed covered amount (90% of $6.3B) | $5.67 billion |
| TraderTraitor's earlier Bybit theft | $1.5 billion, February 2025 |
What to watch
- Whether exchanges block the FBI's listed ether addresses, and how fast the list spreads.
- Whether the conversion into ether continues, or the trail shifts into other coins through instant swap services.
- Binance's planned withdrawal reopening on Sunday, November 1, the first live test of its rebuilt balances.
- Any follow-up US action, such as sanctions designations or charges, that would add legal teeth to the alert.
Key points
- The FBI blamed North Korea on October 31 for taking more than $6 billion from Binance during the October 29 incident.
- The bureau named the operation TraderTraitor and said the actors are shifting the haul chiefly into ether.
- The FBI, the Secret Service and IRS Criminal Investigation urged exchanges and crypto services to refuse transfers tied to the listed addresses.
- TRM Labs had earlier attributed the estimated $6.36 billion theft to TraderTraitor, per Yonhap.
- Binance said it had covered about 90% of the $6.3 billion and planned to restore withdrawals by November 1, per the Straits Times.
MarketRadar take
The attribution is a win for clarity and a limited win for recovery. A public FBI statement plus a wallet list raises the cost of moving funds through venues that check blocklists. It does not freeze coins that have already passed through a swap service, and the hackers' expected next step, DeFi and instant swaps, is designed to exploit exactly that gap. The number to watch now is not the size of the theft, which is settled, but the speed at which the blocklist propagates. Move in days, and laundering options narrow to the least compliant corners of the market. Move in weeks, and the trail will already be cold.
