FBI ties $6B Binance theft to North Korea, urges blocks

The FBI says North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or about October 29, identifying the activity as TraderTraitor. The scale makes it the largest cryptocurrency theft on record, according to [CoinDesk’s report](https://www.coindesk.com/policy/2026/10/31/fbi-confirms-north-korea-s-role-in-usd6-billion-binance-hack-asks-defi-community-to-block-btc-eth-sol-addresses).

Crypto thefts do not end when funds leave an exchange: attackers can move assets through chains and services to make them harder to trace or freeze.

The FBI’s warning puts crypto infrastructure providers on the front line of efforts to stop the stolen assets moving further.

What does the FBI want crypto services to do?

The bureau, alongside the U.S. Secret Service and IRS Criminal Investigation, is asking private-sector firms to block transactions linked to addresses used by TraderTraitor. The request names THORNode and RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual-asset service providers, according to the [FBI’s advisory](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack).

The FBI published lists of addresses holding or previously holding assets from the theft. CoinDesk reported that the advisory included more than 600 Ethereum addresses, nearly 20 Bitcoin addresses and one Solana address.

How are the stolen funds moving?

The FBI says it has observed the attackers converting stolen assets primarily into Ether. It expects them to use decentralized finance tools and instant-swap services for further laundering.

Those routes matter because a swap service can exchange one token for another, while DeFi protocols allow transactions without a traditional exchange acting as the intermediary. Blocking a listed address can disrupt a known route, but the FBI’s warning does not say that the published list covers every address involved.

What should users and providers take from the warning?

For service operators, the advisory is a call to screen transactions against the listed addresses and against funds derived from them. The FBI asks providers to block those transactions; it does not announce a general freeze on Binance customers’ assets or give users a separate action to take.

The laundering effort may keep changing as funds move between addresses and services. CoinDesk reported that blockchain analytics firm Chainalysis had already observed thousands of addresses in use and expected that number to grow as the attackers sought a broader network of services.

The FBI attributes the theft to North Korea’s TraderTraitor group. The advisory focuses on tracing and disrupting the stolen assets as they move; it does not describe how the attackers gained access to Binance or say that the funds have been recovered.