On October 31, 2026, the FBI said North Korean activity it calls TraderTraitor was responsible for the theft of more than $6 billion in virtual assets from Binance. With the U.S. Secret Service and IRS Criminal Investigation, it urged specified private-sector crypto infrastructure providers to block transactions tied to listed addresses. That does not mean all funds have been frozen or recovered.
The FBI attributed the Binance theft to TraderTraitor and said it occurred on or about October 29, 2026.
In a notice dated October 31, the FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance. The bureau uses the name TraderTraitor for this specific activity. It also said the actors had been converting stolen assets primarily into ETH and that it expected further laundering through DeFi and instant-swap services.
This is the FBI’s official attribution. It should be distinguished from earlier assessments by analytics firms and from a finding by a court. The notice does not provide a final technical account of every step in the intrusion.
The FBI, U.S. Secret Service and IRS Criminal Investigation urged named categories of private-sector crypto infrastructure providers to block transactions with or derived from listed addresses.
The notice names THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual-asset service providers. The agencies urged them to block transactions linked to addresses they said TraderTraitor actors were using to launder the stolen assets.
The FBI published addresses across several networks. CoinDesk counted more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address. So “a call to DeFi” is shorthand: the request targets a broader set of infrastructure providers, not only DeFi users.
Blocking may restrict the use of funds at a particular service, but it does not return them to their owner or stop every possible transfer between addresses and platforms.
The FBI request concerns actions by intermediaries and infrastructure providers that may identify and restrict activity involving known addresses. The notice does not say that one service controls all listed addresses or that every on-chain transfer can be stopped. Nor does it say that all assets in or associated with the list have been frozen or returned to Binance.
For operators, the practical takeaway is to check the addresses against the official notice, assess how existing monitoring and response procedures apply, and avoid treating a match as proof of recovery. Implementation depends on the service; the FBI notice does not prescribe one universal technical method.
The incident highlights the value of quickly sharing verified address information across exchanges, analytics firms and infrastructure operators, but it does not establish that all providers have adopted the same measures.
The FBI notice combines an attribution, a list of addresses and a request directed at several types of service providers. For a crypto trading platform, that underscores the importance of having defined procedures for escalating and verifying notices from law enforcement and analytics organizations.
These are general operational-readiness takeaways, not claims about Binance’s internal measures or a legal interpretation binding on every organization.
No. The FBI, U.S. Secret Service and IRS Criminal Investigation urged named categories of private-sector infrastructure organizations and virtual-asset service providers to act. The notice does not describe this as an order to every DeFi user.
The FBI notice says more than $6 billion in virtual assets. That is the bureau's wording and should not be presented as a final, exact loss calculation.
The FBI published Ethereum, Bitcoin and Solana addresses. CoinDesk counted more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address.
No. Blocking can restrict funds at a particular point in the infrastructure, but it does not establish that assets were returned or that every related transfer has been stopped.
On October 31, 2026, The Block reported that attackers redirected at least 12 DeFi websites whose domains were registered through Name.com to pages using Step Drainer. About $138,000 was traced on EVM networks, but total losses remain unknown and the incident’s root cause had not been established at publication time.
Visitors to at least 12 project websites may have been redirected from the expected interface to malicious pages designed to drain connected wallets.
According to The Block, the affected domains were registered through Name.com. Projects named in the report included Flap, Kintsu, Pickle Finance, and Origami Finance. Blockaid said the sites were rigged with Step Drainer, a toolkit that prompts visitors to sign wallet operations.
At the time of publication, 10 domains had been suspended at the registrar level. The report said Flap and Kintsu remained operational. Those details describe the situation at that time, not a current check of each website.
The Block traced about $138,000 to three wallets on EVM networks, but that is not a complete estimate of all possible losses.
The figure covers funds the outlet could trace on EVM networks at the time of reporting. It excludes possible losses on Solana and Aptos, where some affected projects operate. So the $138,000 figure should be described as traced funds, not a final total loss.
The report did not establish a complete victim count. Some projects said they had not received reports of affected users, but that does not establish that no losses occurred.
The available report describes an attack through project websites and wallet interactions; it does not report a confirmed exploit of the underlying smart contracts.
This distinction matters: users often reach a protocol through its website, but the site is a separate part of the infrastructure. If that site is replaced or redirects visitors, users can be prompted to sign a dangerous transaction even when the incident is not caused by a vulnerability in the protocol’s core contract.
The Block reported that some projects said their on-chain contracts were untouched. That is an attributed statement from those projects, not a finding about every affected service.
Review the transactions and permissions you signed, and revoke suspicious token approvals through a trusted wallet interface or an explorer for the relevant network.
Disconnecting a dapp does not by itself revoke previously granted token approvals. Revoking an approval also does not recover funds that have already been transferred.
No. The Block reported that the root cause had not been established at the time of publication.
The report described some projects’ claims of a possible connection to Vercel, but did not establish that Vercel or Name.com had been breached. A shared registrar is an important lead, but it does not by itself prove where attackers gained access.
Until an investigation publishes its findings, it is more accurate to describe the websites as compromised or redirected and to note that the technical path remains unclear.
Projects need to secure registrar accounts, DNS, and domain-change procedures—not just their smart contracts.
The Australian Cyber Security Centre recommends multi-factor authentication, strong unique credentials, restricted administrative access, and monitoring for unusual account activity. Available registrar locks and DNS health monitoring can also help protect high-value domains.
In practice, teams can enable change alerts, routinely review DNS records, and prepare a response plan to take a site offline and notify users quickly. These controls can reduce risk and help teams respond, but they do not guarantee protection from compromise.
The Block said public registration records it reviewed listed Name.com as registrar for all 12 identified affected domains. That does not establish where the compromise occurred.
No. It covers funds The Block traced on EVM networks and excludes possible losses on Solana and Aptos.
Connecting a dapp is not the same as granting permission to move tokens. Check whether you also signed transactions or token approvals, and review permissions with a trusted tool if unsure.
It ends the connection, but does not revoke token approvals already granted. Review and revoke those approvals separately.