The FBI published a cyber alert on Oct 31 saying North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about Oct 29. It calls this activity TraderTraitor, the same name it used for the 2025 Bybit theft. This is the first US government attribution; TRM Labs and Chainalysis had already pointed to North Korea.

• Laundering: the FBI, the US Secret Service and IRS Criminal Investigation have observed the actors converting stolen assets mainly into Ethereum, and expect further laundering through DeFi and instant-swap services.
• Ask to industry: the agencies urge THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions with, or derived from, the listed addresses.
• Indicators: the alert lists more than 600 Ethereum addresses plus Bitcoin and Solana addresses that hold or have held proceeds of the theft.
• Binance: on Oct 31 Binance said it had replenished 90% of the stolen assets and expects to reopen withdrawals on Nov 1, according to Reuters.

What to do: if you run an exchange, bridge, swap service or node, load the FBI's address list into your screening now. Report related information to a local FBI field office or ic3.gov. Binance has still not published a root cause beyond its earlier statement about a compromised DevOps engineer laptop.