The FBI has named North Korea as the party behind the theft of more than $6 billion in digital assets from Binance, the world’s largest crypto exchange. If you hold coins there, the theft is no longer an open question of who: US agencies say a state-backed hacking unit did it.
The bureau’s alert dates the theft to around 29 October 2026 and ties it to a unit it calls TraderTraitor. The US Secret Service and the IRS Criminal Investigation unit are working the case with the FBI.
Stolen coins are being swapped into Ethereum
Investigators have watched the attackers convert the loot mainly into Ethereum (ETH). The alert expects the next step to be more laundering through decentralised finance (DeFi) services and instant swap sites, which let people trade coins without a traditional exchange.
Crypto businesses are being told to turn away any transfer linked to the group’s wallets, and that includes exchanges, swap sites, analytics firms and node operators. The alert lists hundreds of Ethereum addresses and a few dozen Bitcoin addresses it says belong to, or are closely connected with, the group. Tips can go to a local FBI field office or to ic3.gov.
Binance has started letting users withdraw again
Binance said it has covered 95% of the roughly $6.3 billion taken, up from the 90% it reported a day earlier, according to Reuters copy carried by Business Recorder. Withdrawals restart in phases from between 06:00 and 09:00 GMT on Sunday, 1 November, beginning with major tokens such as bitcoin, ether, BNB, Solana, XRP and dogecoin. Binance wrote on X that the last 5% is in thinner markets, so gathering enough of those tokens will take longer.
Covering customers’ balances is not the same as getting the stolen coins back; the attackers still hold them. North Korea has long denied running state hacking units, and its Geneva mission and Chinese embassy did not answer requests for comment, the report says.
We covered the freeze when it began and Binance’s earlier replacement update. The FBI alert does not say how the attackers got in, so the method of the break-in is still unexplained in public.
