FBI names North Korea in the $6.3 billion Binance theft and asks DeFi services to block more than 600 addresses

The FBI has formally blamed North Korea for the largest theft in crypto's history. In an alert published on Saturday, and posted by its Cyber Branch on X at 6:36pm Eastern according to TheStreet, the bureau said the hacking group it tracks as TraderTraitor took more than $6 billion in virtual assets from Binance "on or about October 29, 2026." Binance itself has put the loss at about $6.3 billion and has not named the attacker.

The alert is also a tool for stopping the money. Working with the Secret Service and IRS Criminal Investigation, the FBI said it had seen the group converting the stolen assets primarily into ether and expected further laundering through decentralized finance and instant swap services. It urged THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to "block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets," CoinDesk reported. The list runs to more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address.

Chainalysis chief executive Jonathan Levin said the attackers had already used thousands of addresses and that the number could reach tens of thousands in the coming weeks, according to CoinDesk, which also reported that stablecoin issuers have frozen more than $2.4 billion of the haul. The FBI used the same TraderTraitor label when it blamed North Korea for the $1.5 billion Bybit theft in February 2025, AFP noted.

Asked about the hack on Saturday, President Trump said "we're learning about it" and that his administration would "talk to North Korea about it," CoinDesk reported, citing a White House rapid-response post on X. Binance said earlier on Saturday that it had replaced 90% of the stolen assets and was on track to reopen withdrawals on Sunday.