On this page
Binance hack North Korea: what the FBI says and where the money is now
The FBI said on 31 October 2026 that North Korea was responsible for the theft of about $6.3bn in crypto from the exchange Binance on or about 29 October. It named the group TraderTraitor. Binance has since restored withdrawals in phases from 1 November, and on 12 November the US Justice Department said it had won court authority over more than $1.2bn of frozen funds.
That makes it the largest crypto theft on record, according to BleepingComputer. This article sets out what the FBI alert says, what Binance has done for customers, and which figures remain disputed.
What did the FBI say about the Binance hack?
The FBI alert, published on Saturday 31 October, attributes the theft of more than $6bn in virtual assets to North Korean state-sponsored actors it tracks as TraderTraitor. Security Affairs, which links the alert on the FBI's own site, says the bureau also associates TraderTraitor with the names Lazarus Group and APT38. The FBI's page itself returned an access error when we tried to open it, so the details below come from outlets that read it.
According to BleepingComputer, the alert lists 628 addresses linked to laundering: 608 on Ethereum, 19 on Bitcoin and one on Solana. The FBI, the US Secret Service and IRS Criminal Investigation asked exchanges and other virtual asset providers to block transactions with or derived from those addresses.
The FBI said TraderTraitor had mostly converted the stolen assets into Ether and was likely to push more through decentralised finance platforms and instant swap services, as Cointelegraph reported. Blockchain analytics firms TRM Labs and Chainalysis had linked the theft to the same group before the alert appeared.
How much was stolen, and why do the numbers differ?
Two figures circulate. The FBI and most outlets say more than $6bn, with $6.3bn the commonly quoted number. TRM Labs puts the on-chain total at about $6.36bn across ten blockchains, most of it moved in around 20 minutes from 20:05 UTC on 29 October, per Security Affairs. The Korea Times also cites the TRM estimate of $6.36bn.
The gap probably reflects different measurement methods, but the sources do not say so. We use "about $6.3bn" and treat $6.36bn as the TRM figure.
| Item | Figure | Source |
|---|---|---|
| Theft, FBI wording | More than $6bn | FBI alert, as reported by BleepingComputer |
| Theft, commonly quoted | About $6.3bn | Cointelegraph, TechCrunch |
| Theft, on-chain estimate | About $6.36bn | TRM Labs, via Security Affairs |
| Frozen, reported 12 November | More than $2.7bn | CoinDesk |
| Frozen, expert estimate early on | About $3bn | The Record |
| DOJ court authority | More than $1.2bn | CoinDesk |
How much has been frozen?
This is the figure on which sources disagree most. The Record reported on 2 November that blockchain security experts put frozen funds at about $3bn, and that the Secret Service said it had worked with industry and the Justice Department to freeze a significant portion within minutes. CoinDesk said on 12 November that US authorities and private companies had frozen more than $2.7bn.
Security Affairs itemised roughly $2.7bn: about $2.67bn in stablecoins plus an Arbitrum freeze of 8,426 ETH and 74.6 million ARB. The safest reading is that somewhere between $2.7bn and $3bn is frozen, with the exact total still moving.
Freezes do not mean the money is back. The Record quoted former FBI deputy director Cynthia Kaiser as saying about half the stolen funds had been moved so many times that recovery would be very difficult.
What did the Justice Department announce on 12 November?
CoinDesk reports that the Justice Department received court authority on 12 November to seize more than $1.2bn of the frozen cryptocurrency. It says this sits within the larger frozen total rather than adding to it. The report does not name the court, and the department has not, in the coverage we read, set out how any recovered assets would be returned.
How did Binance restore withdrawals?
Binance froze deposits and withdrawals after the theft, then said it would restore them in phases depending on network and asset. BleepingComputer says the first phase was scheduled for 1 November between 06:00 and 09:00 UTC.
TechCrunch reported that between 06:00 and 15:30 UTC that day Binance processed $4.6bn in withdrawals and $1.0bn in deposits, a net outflow of $3.6bn, or 2.1% of total assets under management. Binance said it had covered 95% of the affected assets and was still buying the remaining, less liquid tokens. Its stated position: "Binance will bear the financial impact of the stolen funds."
The exchange said it would publish a fuller incident report when its investigation ends. Binance first pointed to a compromised engineer's laptop; The Record says it later reported "additional points of breach". We do not go into technical detail here.
What has the White House said?
On the Saturday of the alert, President Trump said: "We don't know if it's North Korea, but if it is, we'll talk to North Korea about it," according to the Korea Times. The same report quotes Secretary of State Marco Rubio saying Mr Trump remains open to talks with Kim Jong-un, with no meeting scheduled.
Analysis: what this changes
This is our analysis, not a finding from the sources.
Three things stand out. First, the attribution is now official, which gives exchanges a clear reason to screen the published addresses. Second, speed mattered: the freezes happened because private firms and agencies acted within minutes, and some platforms argued they could not stop transactions at all. Third, customers were insulated by Binance covering the loss from its own funds, not by recovery of the stolen coins, which is a separate effort.
The pattern is also familiar. The Record lists earlier TraderTraitor-attributed thefts including Bybit in 2025 and Bitget in October 2026, and cites Chainalysis saying North Korea caused almost 90% of crypto hack losses in 2026. Security teams elsewhere are under similar pressure, as recent incidents such as the Maersk data theft from a legacy system, the Notion AI chat transcript exposure and the BrickLink shutdown over unusual activity show, though those cases are unrelated to this one.
Sources
- BleepingComputer: FBI links $6.3 billion Binance crypto heist to North Korean hackers
- Cointelegraph: FBI blames North Korea for record $6.3B Binance hack
- Korea Times: FBI says N. Korea responsible for over $6 bil. crypto theft from Binance
- TechCrunch: Binance resumes withdrawals following $6.3 billion breach
- The Record: FBI blames TraderTraitor for Binance hack
- CoinDesk: DOJ gets court approval to seize $1.2 billion tied to North Korea's Binance hack
- Security Affairs: FBI blames North Korea for $6 billion Binance crypto theft
FAQ
Frequently asked questions
The FBI blames North Korea, specifically the state-sponsored group it calls TraderTraitor, also tracked as Lazarus Group and APT38. The alert was published on 31 October 2026 and covers a theft on or about 29 October.
About $6.3bn is the commonly reported figure, and the FBI says more than $6bn. TRM Labs estimates $6.36bn. The difference is down to who is counting and how.
Yes. Binance began restoring withdrawals in phases from 1 November 2026, depending on network and asset. It says it has covered 95% of the affected assets and will bear the loss itself.
Part of it is frozen, reported at more than $2.7bn by CoinDesk and about $3bn by experts quoted in The Record. On 12 November the Justice Department said it had court authority to seize more than $1.2bn, but frozen is not the same as returned.
Spotted an error? Tell us. Read how we report and correct stories in our editorial policy.
Written by
Mainstream Tech
Newsroom
News and analysis on technology, AI, business, politics and international affairs, from our newsroom in London.
More from Mainstream
