Summary
- Environment: Binance cryptocurrency exchange
- Operational impact: The reviewed advisory does not establish service availability
- Financial impact: More than US$6 billion stolen, according to the FBI
- Record status: Developing record. Reviewed November 2, 2026; updated as evidence emerges.
What happened
The FBI attributed theft of more than US$6 billion in virtual assets from Binance to North Korea. Its October 31 advisory places the theft on or about October 29, 2026 and calls the activity TraderTraitor. [1]
Impact
The amount is a lower bound on stolen assets, not a final net loss after recovery. The FBI, US Secret Service and IRS Criminal Investigation observed conversion of stolen assets primarily into Ethereum. [1]
Timeline
Threat Group & Attack Vector
The reviewed advisory does not establish the initial access method or wallet-key exposure.
Actors
- The FBI attributes the theft to North Korean activity it calls TraderTraitor. [1]
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
The agencies urged virtual-asset services to block transactions connected to identified laundering addresses. They anticipated further laundering through decentralized-finance and instant-swap services; that was a forecast. [1]
Recovery totals and service restoration remain unverified in this briefing.