On October 31, 2026, the FBI said North Korean activity it calls TraderTraitor was responsible for the theft of more than $6 billion in virtual assets from Binance. With the U.S. Secret Service and IRS Criminal Investigation, it urged specified private-sector crypto infrastructure providers to block transactions tied to listed addresses. That does not mean all funds have been frozen or recovered.
What did the FBI say about the Binance hack?
The FBI attributed the Binance theft to TraderTraitor and said it occurred on or about October 29, 2026.
In a notice dated October 31, the FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance. The bureau uses the name TraderTraitor for this specific activity. It also said the actors had been converting stolen assets primarily into ETH and that it expected further laundering through DeFi and instant-swap services.
This is the FBI’s official attribution. It should be distinguished from earlier assessments by analytics firms and from a finding by a court. The notice does not provide a final technical account of every step in the intrusion.
Who did the FBI and partner agencies ask to act?
The FBI, U.S. Secret Service and IRS Criminal Investigation urged named categories of private-sector crypto infrastructure providers to block transactions with or derived from listed addresses.
The notice names THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual-asset service providers. The agencies urged them to block transactions linked to addresses they said TraderTraitor actors were using to launder the stolen assets.
The FBI published addresses across several networks. CoinDesk counted more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address. So “a call to DeFi” is shorthand: the request targets a broader set of infrastructure providers, not only DeFi users.
Why is blocking an address not the same as recovering stolen assets?
Blocking may restrict the use of funds at a particular service, but it does not return them to their owner or stop every possible transfer between addresses and platforms.
The FBI request concerns actions by intermediaries and infrastructure providers that may identify and restrict activity involving known addresses. The notice does not say that one service controls all listed addresses or that every on-chain transfer can be stopped. Nor does it say that all assets in or associated with the list have been frozen or returned to Binance.
For operators, the practical takeaway is to check the addresses against the official notice, assess how existing monitoring and response procedures apply, and avoid treating a match as proof of recovery. Implementation depends on the service; the FBI notice does not prescribe one universal technical method.
What does the request mean for crypto platform security?
The incident highlights the value of quickly sharing verified address information across exchanges, analytics firms and infrastructure operators, but it does not establish that all providers have adopted the same measures.
The FBI notice combines an attribution, a list of addresses and a request directed at several types of service providers. For a crypto trading platform, that underscores the importance of having defined procedures for escalating and verifying notices from law enforcement and analytics organizations.
- Verify addresses and instructions against the primary official notice, not only secondhand reports.
- Identify which transaction flows and services the organization can control.
- Route verified indicators to the staff responsible for monitoring and incident response.
- Distinguish blocking a specific transaction from an intermediary freezing an asset or funds actually being returned.
These are general operational-readiness takeaways, not claims about Binance’s internal measures or a legal interpretation binding on every organization.
FAQ
Did the FBI order every DeFi user to block the addresses?
No. The FBI, U.S. Secret Service and IRS Criminal Investigation urged named categories of private-sector infrastructure organizations and virtual-asset service providers to act. The notice does not describe this as an order to every DeFi user.
How much did the FBI say was stolen from Binance?
The FBI notice says more than $6 billion in virtual assets. That is the bureau's wording and should not be presented as a final, exact loss calculation.
Which networks are included in the address list?
The FBI published Ethereum, Bitcoin and Solana addresses. CoinDesk counted more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address.
Does blocking mean the assets have been returned?
No. Blocking can restrict funds at a particular point in the infrastructure, but it does not establish that assets were returned or that every related transfer has been stopped.