The United States Federal Bureau of Investigation (FBI) has formally accused North Korea of orchestrating the theft of more than $6.3 billion in cryptocurrency from Binance, warning digital asset companies worldwide to block transactions linked to the stolen funds.
In a public notice issued on October 31, 2026, the FBI identified North Korea, officially known as the Democratic People’s Republic of Korea (DPRK), as responsible for the cyberattack, which reportedly occurred around October 29.
The agency said the operation was carried out by a North Korean-linked hacking group known as “TraderTraitor”, adding that investigators were monitoring the movement of the stolen cryptocurrency to prevent the attackers from laundering the funds.
According to the FBI, the hackers have been converting the stolen digital assets primarily into Ethereum (ETH), with plans to move the funds through decentralised finance (DeFi) platforms and instant cryptocurrency exchange services.
The authorities warned that the suspected attackers were preparing to move the assets through several transactions and cryptocurrency platforms to conceal their origins and make it more difficult for investigators to recover them.
The FBI said it had been working with the United States Secret Service (USSS) and the Internal Revenue Service Criminal Investigation Division (IRS-CI) to track the stolen funds and identify the wallets associated with the operation.
In response, the three agencies have called on cryptocurrency exchanges, blockchain companies and other virtual asset service providers to identify and block transactions connected to the stolen cryptocurrency.
The warning specifically targets THORNode operators, remote procedure call (RPC) node operators, instant cryptocurrency exchanges, DeFi platforms, blockchain analytics companies and other businesses operating within the digital asset ecosystem.
The FBI disclosed that its investigators had observed the TraderTraitor hackers converting the stolen assets mainly into Ethereum, with further laundering activities expected through decentralised financial services and instant-swap platforms.
The agency also released a comprehensive list of cryptocurrency wallet addresses believed to be controlled by, or associated with, the North Korean hackers.
The identified addresses cover several blockchain networks, including Ethereum, Bitcoin and Solana.
According to the FBI, publishing the wallet addresses would enable cryptocurrency platforms and financial technology companies to recognise suspicious transactions, prevent the movement of the stolen assets through their services and assist ongoing investigations.
The agencies warned that cryptocurrency service providers should take immediate steps to identify and block transactions involving the listed addresses.
The FBI also appealed to individuals and organisations with information about the cyberattack to contact their nearest FBI field office or submit reports through the agency’s Internet Crime Complaint Center.
The latest announcement follows an earlier report by SaharaReporters that blockchain intelligence companies had linked the Binance cryptocurrency theft to North Korean hackers.
Researchers from TRM Labs and Chainalysis had reportedly identified similarities between the Binance incident and previous cryptocurrency thefts attributed to North Korea.
TRM Labs expressed strong confidence in the suspected North Korean connection, pointing to technical and operational similarities with earlier hacking operations, including the massive cryptocurrency theft involving exchange Bybit in 2025.
The FBI‘s latest statement now represents an official attribution of the Binance attack to North Korea by US law enforcement authorities, alongside a coordinated effort to prevent the stolen cryptocurrency from entering the wider digital asset market.
Following the security breach, Binance disclosed that a compromised computer belonging to one of its engineers was being investigated as a possible entry point for the attackers.
The cryptocurrency exchange said its security team was examining several factors that might have contributed to the incident.
However, Binance maintained that its preliminary investigation had not uncovered evidence that customers’ wallet private keys were exposed during the attack.
The exchange also pledged to absorb the financial losses arising from the incident and said it was collaborating with other cryptocurrency companies and blockchain investigators to trace and freeze the stolen funds.
Binance had previously announced that approximately $3 billion worth of the affected assets had been frozen through cooperation with other industry participants.
The FBI said it remained committed to identifying, disrupting and countering North Korea’s cybercrime activities, particularly operations involving cryptocurrency theft and the unlawful acquisition of virtual assets.
The agency urged cryptocurrency exchanges and other private-sector operators to cooperate with investigators by monitoring suspicious transactions and blocking funds connected to the wallet addresses identified in its security notice.
The development highlights growing international concerns over North Korea-linked cyber operations targeting cryptocurrency platforms, with authorities warning that stolen digital assets could be moved across multiple blockchain networks before their origins are successfully concealed.