Binance (BNB) Hack: FBI Says North Korea Stole $6B+ in Record Heist

By Nodora News · 1 November 2026 · Updated 1 November

The FBI says North Korea's TraderTraitor group stole more than $6 billion from Binance (BNB), as the exchange readies to reopen withdrawals after the hack.

The FBI has formally named North Korea as the force behind the record Binance hack. In a cyber alert published on Saturday, October 31, 2026, the bureau said the Democratic People's Republic of Korea (DPRK) was responsible for stealing more than $6 billion in virtual assets from Binance, the exchange behind the BNB token, on or about October 29. It is the first official US government attribution for the largest crypto theft on record, and it comes as Binance prepares to reopen customer withdrawals.

Key takeaways

• The FBI says North Korea stole more than $6 billion in crypto from Binance around October 29, 2026.
• The bureau tied the attack to TraderTraitor, the same North Korean group it blamed for the $1.5 billion Bybit hack in February 2025.
• Working with the US Secret Service and IRS Criminal Investigation, the FBI says the hackers have been converting stolen assets mainly into Ethereum (ETH).
• Exchanges, DeFi platforms and analytics firms are being asked to block transactions linked to the hackers' wallet addresses.
• Binance says it has replenished about 90% of the stolen assets and is still targeting Sunday, November 1 to restart withdrawals.

What Did the FBI Say About the Binance Hack?

The alert, posted on the FBI's cyber alerts page, is short but direct. It states that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance and identifies the operation as "TraderTraitor", a name the US government uses for one of Pyongyang's most active crypto-theft units.

According to the FBI, investigators working alongside the US Secret Service and the Internal Revenue Service's Criminal Investigation division have watched the attackers convert most of the stolen funds into Ethereum. The bureau expects the next phase to involve heavier laundering through decentralized finance (DeFi) protocols and instant-swap services, which let users trade one coin for another quickly and often without an account.

The FBI asked crypto exchanges, blockchain node operators, analytics firms and other virtual asset service providers to block any transactions involving the addresses the hackers are using.

Who Is TraderTraitor?

TraderTraitor is a North Korean hacking group that targets crypto companies, often by compromising employees through fake job offers, malicious software or poisoned developer tools. The FBI previously blamed the same group for the $1.5 billion theft from Bybit in February 2025, which until this week was the biggest crypto hack ever.

Private investigators reached the same conclusion first. Blockchain intelligence firm TRM Labs attributed the Binance theft to TraderTraitor "with high confidence" earlier in the week, and Chainalysis also linked the attack to the group. TRM said the hackers began preparing at least 36 hours before the theft, ran several test transfers between their own wallets, and then moved most of the money in about 20 minutes. Our earlier report on how the record $6.3 billion Binance hack unfolded covers those first hours in detail.

How Much Was Stolen, and What Has Binance Recovered?

The numbers have shifted slightly as more data came in, but they broadly agree:

• Stolen: about $6.3 billion according to Binance, with TRM Labs estimating $6.36 billion. The FBI says "more than $6 billion".
• Frozen: roughly $3 billion in affected assets frozen on-chain with help from industry partners, according to Binance.
• Set aside: about $6.34 billion in company funds, drawn from Binance's Secure Asset Fund for Users (SAFU), part of its futures insurance fund and its corporate treasury.
• Replenished: about 90% of the stolen assets as of October 31, up from about 80% a day earlier.

Binance says customer balances in ten assets are now fully backed: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The remaining gap is mostly in less liquid tokens that take longer to buy. It's worth being clear that "replenished" means Binance used its own money to buy replacement tokens. It does not mean 90% of the stolen funds have been taken back from the attackers. We covered that update in Binance (BNB) Replaces 90% of $6.3B Stolen in Record Hack.

Binance co-CEO Richard Teng has said the attacker abused Ethereum's EIP-7702 authorization feature, which lets a regular wallet temporarily act like a smart contract, to gain execution rights over a hot wallet and get around normal approval controls. The company has also pointed to a compromised engineer's laptop as an early entry point.

Why the FBI Attribution Matters

An official attribution changes the picture in a few practical ways. First, it gives compliance teams at exchanges and stablecoin issuers firmer grounds to freeze funds tied to the hackers' addresses. Second, North Korean entities are under US sanctions, so platforms that knowingly process these funds face serious legal risk. Third, it raises the pressure on DeFi protocols and swap services that the FBI expects the hackers to use next.

Laundering is already under way. Earlier on-chain data showed the attacker swapping stolen stablecoins into hundreds of millions of TRX on the TRON network, as covered in our report on the hacker's 638 million TRX position. With the FBI now naming ETH as the main destination, Ethereum-based mixers, bridges and swap routes are likely to face the closest scrutiny.

BNB and Bitcoin Price Reaction

Markets barely moved on the news, which had been widely expected after the private-sector attributions. Prices from the OKX public API at about 10:50 AM AEDT on November 1:

• BNB: about $703, down 0.2% over 24 hours
• Bitcoin (BTC): about $77,490, up 0.3%
• Ethereum (ETH): about $2,254, up 0.5%

The bigger test for BNB is likely to be the withdrawal restart rather than the attribution itself. You can track live prices on Nodora Charts.

What to Watch Next

• Withdrawals: Binance says it remains on track to reopen withdrawals on Sunday, November 1, subject to security checks and final confirmation. A smooth restart would be the clearest sign the exchange is back to normal.
• Proof of reserves: Binance took a fresh reserves snapshot at 00:00 UTC on October 31 and expects its zero-knowledge proof, which lets users verify their balances are backed without exposing private data, to be ready by about November 3.
• Laundering and freezes: watch for new address lists, further freezes by stablecoin issuers, and any sanctions action targeting wallets linked to the theft.
• The last 10%: Binance is still buying the remaining less liquid tokens through the market and over-the-counter desks.

This article is for information only and is not financial advice.

#Binance #BNB #North Korea #Hack #FBI

This article is general information, not financial advice.