---
title: FBI: North Korea's TraderTraitor stole more than $6 billion from Binance; agencies ask services to block listed laundering addresses | ctxsec
url: https://ctxsec.com/items/fbi-attributes-binance-6b-theft-tradertraitor-608-eth-addresses
description: "The FBI said on Oct 31 that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about Oct 29, naming the activity TraderTraitor. With the Secret Service and IRS-CI it has seen the actors converting the assets mainly into Ethereum, and it published Ethereum, Bitcoin and Solana addresses for exchanges and node operators to block."
status: "official (FBI cyber alert, Oct 31)"
published: 2026-10-31
---

> The FBI said on Oct 31 that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about Oct 29, naming the activity TraderTraitor. With the Secret Service and IRS-CI it has seen the actors converting the assets mainly into Ethereum, and it published Ethereum, Bitcoin and Solana addresses for exchanges and node operators to block.

[← Cybersecurity News](/news) · [markdown](/items/fbi-attributes-binance-6b-theft-tradertraitor-608-eth-addresses.md)

official (FBI cyber alert, Oct 31)

2026-10-31

### FBI: North Korea's TraderTraitor stole more than $6 billion from Binance; agencies ask services to block listed laundering addresses

The **FBI** published a cyber alert on **Oct 31** saying North Korea was responsible for the theft of more than **$6 billion** in virtual assets from **Binance** on or about Oct 29. It calls this activity **TraderTraitor**, the same name it used for the 2025 Bybit theft. This is the first US government attribution; TRM Labs and Chainalysis had already pointed to North Korea.

- **Laundering:** the FBI, the US Secret Service and IRS Criminal Investigation have observed the actors converting stolen assets mainly into Ethereum, and expect further laundering through DeFi and instant-swap services.
- **Ask to industry:** the agencies urge THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions with, or derived from, the listed addresses.
- **Indicators:** the alert lists more than 600 Ethereum addresses plus Bitcoin and Solana addresses that hold or have held proceeds of the theft.
- **Binance:** on Oct 31 Binance said it had replenished 90% of the stolen assets and expects to reopen withdrawals on Nov 1, according to Reuters.

**What to do:** if you run an exchange, bridge, swap service or node, load the FBI's address list into your screening now. Report related information to a local FBI field office or [ic3.gov](https://www.ic3.gov). Binance has still not published a root cause beyond its earlier statement about a compromised DevOps engineer laptop.

Sources: [FBI cyber alert: North Korea Responsible for $6 Billion+ Binance Attack (Oct 31)](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack) · [AP: FBI says North Korean hackers behind Binance crypto heist (Oct 31)](https://apnews.com/article/binance-crypto-hack-north-korea-fbi-883f18140c1e21ce0c38781e72cbe315) · [CBC/Reuters: Binance says billions replaced from hack that FBI blames on North Korea (Oct 31)](https://www.cbc.ca/news/world/binance-hack-north-korea-9.7404502)