---
title: "Binance virtual-asset theft"
description: "The FBI attributes more than US$6 billion in virtual-asset theft from Binance to North Korean TraderTraitor activity."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-02"
canonical_url: "https://www.ally.security/incidents/binance-virtual-asset-theft-2026"
markdown_url: "https://www.ally.security/incidents/binance-virtual-asset-theft-2026.md"
stix_url: "https://www.ally.security/incidents/binance-virtual-asset-theft-2026/stix.json"
---

# Binance virtual-asset theft

The FBI reports a major virtual-asset theft and seeks to disrupt laundering.

Last modified Nov 2, 2026 · 1 source

## Summary

- **Environment:** Binance cryptocurrency exchange
- **Operational impact:** The reviewed advisory does not establish service availability
- **Financial impact:** More than US$6 billion stolen, according to the FBI

## What happened

The [FBI](https://www.fbi.gov/) attributed theft of more than **US$6 billion** in virtual assets from [Binance](https://www.binance.com/) to North Korea. Its [October 31 advisory](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack) places the theft **on or about October 29, 2026** and calls the activity TraderTraitor. [1](#source-1)

## Impact

The amount is a lower bound on stolen assets, not a final net loss after recovery. The FBI, [US Secret Service](https://www.secretservice.gov/) and [IRS Criminal Investigation](https://www.irs.gov/compliance/criminal-investigation) observed conversion of stolen assets primarily into Ethereum. [1](#source-1)

## Timeline

### October 31, 2026 — FBI attribution published

The [advisory](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack) attributes the theft and describes asset tracing. [1](#source-1)

### November 2, 2026 — Briefing updated

This briefing was last reviewed and updated on November 2, 2026.

## Threat Group & Attack Vector

The reviewed advisory does not establish the initial access method or wallet-key exposure.

### Actors

- The FBI attributes the theft to North Korean activity it calls TraderTraitor. [1](#source-1)

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

The agencies urged virtual-asset services to block transactions connected to identified laundering addresses. They anticipated further laundering through decentralized-finance and instant-swap services; that was a forecast. [1](#source-1)

Recovery totals and service restoration remain unverified in this briefing.

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/binance-virtual-asset-theft-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### North Korea Responsible for $6 Billion+ Binance Attack

official · Federal Bureau of Investigation · Oct 31, 2026

<https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Binance virtual-asset theft: The FBI, US Secret Service and IRS Criminal Investigation observed the actors converting stolen assets primarily into Ethereum.
2. **Occurred At · 100% confidence · current**  
   FBI publishes attribution and disruption advisory: 2026-10-31
3. **Resulted In · 100% confidence · current**  
   Binance virtual-asset theft: FBI publishes attribution and disruption advisory
4. **Attributed To · 100% confidence · current**  
   Binance virtual-asset theft: TraderTraitor
5. **Resulted In · 100% confidence · current**  
   Binance virtual-asset theft: The agencies urged private-sector virtual-asset services to block transactions involving or derived from identified laundering addresses.
6. **Resulted In · 100% confidence · current**  
   Binance virtual-asset theft: The FBI attributed the theft of more than US$6 billion in virtual assets from Binance to North Korea and dated it to on or about October 29, 2026. It calls the specific malicious activity TraderTraitor.
7. **Resulted In · 100% confidence · current**  
   Binance virtual-asset theft: The agencies expected further laundering through decentralized-finance and instant-swap services; the advisory presents that stage as an expectation, not an observed completed event.
8. **Affected Organization · 100% confidence · current**  
   Binance virtual-asset theft: Binance

</details>