On October 31, 2026, the FBI said North Korean activity it calls TraderTraitor was responsible for the theft of more than $6 billion in virtual assets from Binance. With the U.S. Secret Service and IRS Criminal Investigation, it urged specified private-sector crypto infrastructure providers to block transactions tied to listed addresses. That does not mean all funds have been frozen or recovered.
The FBI attributed the Binance theft to TraderTraitor and said it occurred on or about October 29, 2026.
In a notice dated October 31, the FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance. The bureau uses the name TraderTraitor for this specific activity. It also said the actors had been converting stolen assets primarily into ETH and that it expected further laundering through DeFi and instant-swap services.
This is the FBI’s official attribution. It should be distinguished from earlier assessments by analytics firms and from a finding by a court. The notice does not provide a final technical account of every step in the intrusion.
The FBI, U.S. Secret Service and IRS Criminal Investigation urged named categories of private-sector crypto infrastructure providers to block transactions with or derived from listed addresses.
The notice names THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual-asset service providers. The agencies urged them to block transactions linked to addresses they said TraderTraitor actors were using to launder the stolen assets.
The FBI published addresses across several networks. CoinDesk counted more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address. So “a call to DeFi” is shorthand: the request targets a broader set of infrastructure providers, not only DeFi users.
Blocking may restrict the use of funds at a particular service, but it does not return them to their owner or stop every possible transfer between addresses and platforms.
The FBI request concerns actions by intermediaries and infrastructure providers that may identify and restrict activity involving known addresses. The notice does not say that one service controls all listed addresses or that every on-chain transfer can be stopped. Nor does it say that all assets in or associated with the list have been frozen or returned to Binance.
For operators, the practical takeaway is to check the addresses against the official notice, assess how existing monitoring and response procedures apply, and avoid treating a match as proof of recovery. Implementation depends on the service; the FBI notice does not prescribe one universal technical method.
The incident highlights the value of quickly sharing verified address information across exchanges, analytics firms and infrastructure operators, but it does not establish that all providers have adopted the same measures.
The FBI notice combines an attribution, a list of addresses and a request directed at several types of service providers. For a crypto trading platform, that underscores the importance of having defined procedures for escalating and verifying notices from law enforcement and analytics organizations.
These are general operational-readiness takeaways, not claims about Binance’s internal measures or a legal interpretation binding on every organization.
No. The FBI, U.S. Secret Service and IRS Criminal Investigation urged named categories of private-sector infrastructure organizations and virtual-asset service providers to act. The notice does not describe this as an order to every DeFi user.
The FBI notice says more than $6 billion in virtual assets. That is the bureau's wording and should not be presented as a final, exact loss calculation.
The FBI published Ethereum, Bitcoin and Solana addresses. CoinDesk counted more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address.
No. Blocking can restrict funds at a particular point in the infrastructure, but it does not establish that assets were returned or that every related transfer has been stopped.
On October 31, 2026, The Block reported that attackers redirected at least 12 DeFi websites whose domains were registered through Name.com to pages using Step Drainer. About $138,000 was traced on EVM networks, but total losses remain unknown and the incident’s root cause had not been established at publication time.
Visitors to at least 12 project websites may have been redirected from the expected interface to malicious pages designed to drain connected wallets.
According to The Block, the affected domains were registered through Name.com. Projects named in the report included Flap, Kintsu, Pickle Finance, and Origami Finance. Blockaid said the sites were rigged with Step Drainer, a toolkit that prompts visitors to sign wallet operations.
At the time of publication, 10 domains had been suspended at the registrar level. The report said Flap and Kintsu remained operational. Those details describe the situation at that time, not a current check of each website.
The Block traced about $138,000 to three wallets on EVM networks, but that is not a complete estimate of all possible losses.
The figure covers funds the outlet could trace on EVM networks at the time of reporting. It excludes possible losses on Solana and Aptos, where some affected projects operate. So the $138,000 figure should be described as traced funds, not a final total loss.
The report did not establish a complete victim count. Some projects said they had not received reports of affected users, but that does not establish that no losses occurred.
The available report describes an attack through project websites and wallet interactions; it does not report a confirmed exploit of the underlying smart contracts.
This distinction matters: users often reach a protocol through its website, but the site is a separate part of the infrastructure. If that site is replaced or redirects visitors, users can be prompted to sign a dangerous transaction even when the incident is not caused by a vulnerability in the protocol’s core contract.
The Block reported that some projects said their on-chain contracts were untouched. That is an attributed statement from those projects, not a finding about every affected service.
Review the transactions and permissions you signed, and revoke suspicious token approvals through a trusted wallet interface or an explorer for the relevant network.
Disconnecting a dapp does not by itself revoke previously granted token approvals. Revoking an approval also does not recover funds that have already been transferred.
No. The Block reported that the root cause had not been established at the time of publication.
The report described some projects’ claims of a possible connection to Vercel, but did not establish that Vercel or Name.com had been breached. A shared registrar is an important lead, but it does not by itself prove where attackers gained access.
Until an investigation publishes its findings, it is more accurate to describe the websites as compromised or redirected and to note that the technical path remains unclear.
Projects need to secure registrar accounts, DNS, and domain-change procedures—not just their smart contracts.
The Australian Cyber Security Centre recommends multi-factor authentication, strong unique credentials, restricted administrative access, and monitoring for unusual account activity. Available registrar locks and DNS health monitoring can also help protect high-value domains.
In practice, teams can enable change alerts, routinely review DNS records, and prepare a response plan to take a site offline and notify users quickly. These controls can reduce risk and help teams respond, but they do not guarantee protection from compromise.
The Block said public registration records it reviewed listed Name.com as registrar for all 12 identified affected domains. That does not establish where the compromise occurred.
No. It covers funds The Block traced on EVM networks and excludes possible losses on Solana and Aptos.
Connecting a dapp is not the same as granting permission to move tokens. Check whether you also signed transactions or token approvals, and review permissions with a trusted tool if unsure.
It ends the connection, but does not revoke token approvals already granted. Review and revoke those approvals separately.
According to a customer notice reported by The Block, an intruder accessed some user IDs, full names, email addresses and organizational role labels. Chainalysis says its investigation has found no evidence so far of access to investigation content, authentication credentials or session tokens; the exact records affected are still being determined.
The customer notice, as reported by The Block, lists user IDs, full names, email addresses and organizational role labels.
Chainalysis disclosed unauthorized access to its systems and internal tools. The Block reported that the company’s customer notice identified some platform user data as accessed.
Chainalysis said it would provide customers with a breakdown of the specific records affected. The available notices do not give a total number of users or organizations.
The company said it had found no evidence, at the time of its notice, of unauthorized access to investigation content, authentication credentials or session tokens.
In its public notice, Chainalysis said its investigation had found no evidence of unauthorized access to investigation content, authentication credentials or session tokens. This describes the company’s findings at the time of publication; it is not a final independent audit.
Chainalysis said it was working with cybersecurity experts, hardening its systems and notifying customers. It is still determining which specific records were affected at each organization.
The Block attributed the phrase to a customer notice, but available statements do not identify a specific tool, attack sequence or level of attacker autonomy.
The phrase “offensive agentic techniques” appears in The Block’s account of the customer notice. Chainalysis’s public post does not explain the term technically, so the wording alone does not establish whether a particular AI tool was used or what role it played.
The number of affected users and organizations, the intrusion details and the final list of accessed records have not been disclosed in the available notices. Chainalysis also said the incident is unrelated to the recent theft of crypto assets from Binance.
For crypto companies, the incident is a reminder to account for vendor security risks and limit access to customer data. That is a practical implication of the incident, not a claim that related follow-on attacks have been confirmed.
Chainalysis said it had found no evidence of access to authentication credentials or session tokens at the time of its notice. Its investigation is ongoing.
The available notices do not specify the number of affected users or organizations. Chainalysis said it was determining which records were involved for each customer.
No. Chainalysis said its security incident is not related to the recent theft of crypto assets from Binance.
On October 30, 2026, Donald Trump said U.S. officials were looking into the Binance hack. Industry and political voices used the incident to call for stronger exchange oversight, customer-asset safeguards and cybersecurity standards. Those calls did not mean new rules had already been enacted, and the available reporting does not establish that any proposed rules would have prevented the attack.
Trump said officials were looking into the Binance hack; his comments did not establish who was responsible or resolve the investigation.
On October 30, 2026, President Donald Trump told reporters that officials were looking into the Binance incident. Asked about possible North Korean involvement, he said, “We’re looking at that.” The remark indicates official attention, but it is not a final attribution or a report of completed investigative findings.
In an update dated October 30, Binance estimated the loss at about $6.3 billion, said it would cover customer losses and reported temporarily suspending withdrawals while it reviewed affected systems. These are Binance’s statements as of that date, not independent confirmation that reimbursement had been completed.
Proposals discussed after the incident include more federal oversight of exchanges, stronger customer-asset protections and cybersecurity requirements.
The Digital Chamber urged Congress to give the CFTC authority over crypto exchanges. Its call also addressed separating customer assets from company funds in bankruptcy. These are an industry group’s policy requests, not evidence that the requirements are already law.
Separately, Representative Maxine Waters called for stronger consumer protections, financial safeguards and cybersecurity standards. That is the stated position of a Democratic member of the House Financial Services Committee; it should not be presented as an enacted or bipartisan measure.
CFTC Chair Michael Selig also connected the incident to the debate over crypto oversight. The Block reported that the agency had proposed a framework earlier in October for certain types of crypto trading. The reported scope is specific; it should not be treated as a single rule already covering every exchange and product.
The reporting reviewed describes calls and proposals, not new rules enacted in response to the incident; it also does not show that a particular law would have prevented the breach.
It is useful to distinguish among rules already in force, a regulator’s proposals and requests for Congress to legislate. The October 30 reports describe statements and proposals; they do not establish that the newly discussed measures had taken effect.
The debate still matters to trading-infrastructure operators because it puts access controls, withdrawal approvals, customer-asset protection and incident readiness back in focus. Platforms can review those controls regardless of whether lawmakers adopt any particular proposal.
It would be speculative to say that new rules would automatically have stopped this attack or guaranteed recovery of the funds. Binance said its investigation had uncovered additional breach points and that it had found no evidence of leaked wallet private keys at that time. The full technical account was still under investigation.
No. He said officials were looking into the incident and possible North Korean involvement. That was not a final attribution.
The group urged Congress to give the CFTC authority over crypto exchanges. The request is a policy proposal, not a description of an existing new law.
The sources reviewed describe proposals and calls for legislation. They do not confirm that those proposed requirements have been enacted and taken effect.
There is no basis for that guarantee. Binance said it would cover customer losses, but that is the company’s stated commitment, not an outcome guaranteed by the proposals.
On October 29, 2026, Binance reported a security incident and put its preliminary overall impact at about $6.3 billion. The more-than-$5.7-billion figure in reports referred to the value of assets held in wallets linked to the suspected attacker, not a final tally of irrecoverable losses. Binance also said roughly $3 billion in assets had been frozen; the cause was still under investigation.
Binance reported a potential security incident affecting a large volume of crypto assets and began investigating.
Reports published on October 29 cited more than one estimate. Binance later put the incident’s preliminary overall impact at about $6.3 billion. That company estimate does not mean the entire amount was a final, unrecoverable loss.
It is important to distinguish the reported incident, preliminary estimates, and the findings of a completed investigation. Early reports had not established the full attack mechanism or final financial impact.
The figures describe different measures: Binance’s preliminary estimate of about $6.3 billion in overall impact and CoinDesk’s report of more than $5.7 billion in assets held in wallets linked to the suspected attacker.
CoinDesk reported that wallets linked to the suspected attacker held assets worth more than $5.7 billion at one point. The same report discussed other estimates of the assets stolen. The headline claim that Binance “lost $5.7 billion” therefore compresses several different measures: assets tracked in wallets, the exchange’s estimate of overall impact, and any eventual confirmed losses.
When comparing incident figures, check what each number measures: asset movements, the exchange’s own estimate, balances in specific wallets, or confirmed losses.
Binance’s preliminary account pointed to a potentially compromised DevOps engineer’s laptop, but that account is not a final investigative finding.
In its preliminary account, Binance said a compromised device may have enabled access to a service container and the submission of unauthorized withdrawal transactions. The exchange also said it had found no evidence that wallet private keys were leaked.
These are early findings reported by the company, not independent confirmation of the complete technical sequence. While the investigation continues, neither a specific vulnerability nor an attacker’s identity should be presented as conclusively established.
Binance said roughly $3 billion in assets had been frozen and said it would cover incident-related losses using SAFU and company funds.
Binance reported that roughly $3 billion had been frozen on-chain. The exchange also said deposits were no longer affected and that it would cover losses related to the incident using SAFU and company funds. These are the exchange’s statements, not an independent assessment of a completed recovery.
For crypto trading-platform operators and developers, the incident is a reminder to review layered controls. Practical areas include employee access boundaries, endpoint security, approval and monitoring of critical withdrawals, anomaly detection, and incident-response plans. These are general risk-management considerations; they do not establish that any particular missing control caused this incident.
No. CoinDesk used that figure for the value of assets in linked wallets. Binance separately put the preliminary overall impact at about $6.3 billion; neither figure should be treated as a final tally of irrecoverable losses.
Binance reported that about $3 billion in assets had been frozen on-chain. The figure reflects the update available at the time and could change.
Binance said it had found no evidence of a wallet private-key leak. That was a report of preliminary findings, not independent confirmation of every investigative detail.
The sources available for this article do not establish a definitive attribution. Early suggestions about a specific group should not be treated as confirmed.
In an attack detected on October 25, 2026, an intruder took over five Bitonic customer accounts and withdrew bitcoin from three of them. Bitonic said it fully reimbursed affected customers, fixed the vulnerability, and is continuing its investigation.
Bitonic said an intruder accessed part of its systems on the evening of October 25 and took over five customer accounts.
Bitcoin was withdrawn from three accounts. An ANP report published on October 28 put the loss at approximately €200; the exact amount in BTC was not publicly specified. Bitonic said it fully reimbursed the affected customers.
Early reports described unauthorized access and changes to account login details. A later update said five accounts were taken over, while withdrawals occurred from three.
In an interview with BNR, Bitonic’s CEO linked the intrusion to a vulnerability in the PDF-upload feature used for verification, while the investigation remains ongoing.
The CEO said the vulnerability involved processing PDF files uploaded through the verification feature. This is the company’s explanation as reported in an interview, not a final published technical postmortem.
After discovering the issue, Bitonic took affected systems offline as a precaution, then fixed the vulnerability and restored services. The available reports do not provide a full technical account or final investigation results.
There is no final confirmation that other customers’ personal data was accessed or stolen; Bitonic said it could not rule out that possibility while its investigation continued.
As of October 28, the company said it had no indication that personal data beyond the affected accounts had been taken, but noted that its review was ongoing. The available information therefore supports neither a claim of a confirmed wider data leak nor a definitive claim that no access occurred.
Media reports say Bitonic preserved digital evidence and planned to provide it to police. The company also reported contacting relevant supervisory authorities.
Customers should follow Bitonic’s official notices, use app-based authentication, and never share login codes or send funds in response to suspicious requests.
Reports about the incident advised customers to review their account security and watch for messages impersonating Bitonic. Practical steps include:
These steps do not replace Bitonic’s official instructions. Customers with concerns should contact the company through verified channels.
An update on October 28 said five accounts were taken over. Bitcoin was withdrawn from three of them.
Yes. The company said it fully reimbursed the affected customers.
No. As of October 28, Bitonic had not reported a confirmed breach of data beyond the affected accounts, but it said access could not be ruled out while the investigation continued.
Bitonic’s CEO linked the intrusion to a vulnerability in the PDF-upload feature used for verification. The available reports did not include a final technical postmortem.