The FBI has blamed North Korea for stealing more than $6 billion in cryptocurrency from Binance, in what investigators are calling the largest theft in crypto history, and possibly the largest single theft of any kind ever recorded. The announcement, made on October 31, 2026, turned a shocking exchange hack into a geopolitical story, and it raised urgent questions for millions of crypto users around the world. Here is what is confirmed, what is still alleged, and what happens next.
On October 29, 2026, attackers drained an estimated $6.3 billion to $6.43 billion in digital assets from Binance, the world’s largest cryptocurrency exchange, across ten or more blockchain networks. Blockchain intelligence firms including Elliptic and TRM Labs put the total at $6.36 billion to $6.43 billion, while Binance itself said its hot wallets were compromised for approximately $6.3 billion. The theft unfolded with astonishing speed: TRM Labs reported that most of the funds were moved in about twenty minutes. Within days, the FBI pointed the finger at TraderTraitor, its name for a North Korean state-linked hacking operation, and warned that the stolen funds were already being moved and laundered.
That attribution matters enormously, but it is important to be precise about what it is. The FBI’s statement is the official position of the United States government, based on its investigation alongside the US Secret Service and the IRS Criminal Investigation division. It is not a court conviction, and North Korea has not admitted involvement. When reporters asked President Donald Trump about the case on the night of October 31, he said investigators were still learning about it and that it was not yet certain North Korea was involved, adding that it could yet be determined that it was. That tension, between an FBI attribution and a president urging caution, is part of the story, and honest reporting should keep both facts in view.
What the FBI Says About the Binance Hack
In its October 31 cyber alert, the FBI said North Korea’s TraderTraitor group was responsible for the theft of more than $6 billion in virtual assets from Binance. The agency said it had observed TraderTraitor actors converting the stolen assets primarily into Ethereum, one of the world’s largest cryptocurrencies, and it expects the group to attempt further laundering through decentralised finance platforms and instant swap services, which trade one coin for another without requiring an account.
The FBI asked cryptocurrency exchanges, blockchain analytics companies and other services to block transactions linked to addresses associated with the theft, to stop the money being laundered and its origins covered up. The agency said it is working with the Secret Service and IRS Criminal Investigation to track the stolen assets as they move across blockchains. That joint effort is significant, because tracing the Binance hack is a race against time: once stolen coins are swapped, split into small amounts, and passed through mixers or smaller exchanges, they become far harder to follow.
Elliptic, the blockchain analytics firm, had already assessed TraderTraitor as the likely culprit before the FBI announcement, and updated its analysis on October 31 to reflect the official attribution. Elliptic noted that this single incident almost doubles the total cryptoassets stolen by North Korea-linked actors, who are believed to have taken more than $6.5 billion in cryptoassets in recent years, including more than $1 billion tracked by the firm in 2026 before this incident. The US government has linked these thefts to the funding of North Korea’s weapons programmes, which is why these hacks are treated as national security cases, not just financial crimes.
How the Theft Unfolded
Binance first paused withdrawals while its team conducted security checks, and customers were left waiting for news. In a recovery update, co-chief executives Yi He and Richard Teng confirmed that hot wallets, the internet-connected wallets used for day-to-day transactions, had been compromised, resulting in a loss of approximately $6.3 billion worth of token assets. The Wall Street Journal later reported that the hackers plundered the wallets by breaking into a Binance engineer’s laptop, among other breaches, citing Binance’s account of the attack. The full technical details have not yet been published, and Binance has said it will release a post-incident report once its investigation is complete.
The scale of the response was as dramatic as the theft. In response to the Binance hack, Binance said it set aside more than $6.34 billion of company funds to cover users’ affected assets, holding about $5 billion in the same cryptocurrencies that were stolen and buying the remaining $1.3 billion through market channels. By November 1, the exchange said it had replenished approximately 95 per cent of affected assets, up from about 90 per cent the previous day. Stablecoin issuers Tether and Circle, along with other crypto firms, managed to freeze roughly $3 billion of the stolen sum, leaving around $3.3 billion still under the hackers’ control, according to the Wall Street Journal’s reporting. Elliptic separately verified $2.85 billion of frozen or seized funds, about 44 per cent of the theft, almost all of it in the stablecoins USDT and USDC. The figures differ slightly because firms count frozen funds at different moments and by different methods, but they agree on the broad picture: a large share was frozen quickly, and a large share remains at large.
Withdrawals began to reopen in phases from Sunday, November 1, starting with bitcoin, then ether and major stablecoins on the Ethereum network and Binance’s own BNB Smart Chain. Binance said that in the first nine and a half hours after withdrawals resumed, it saw a net outflow of $3.64 billion, from about $4.65 billion in withdrawals against $1.1 billion in deposits, which it said represented 2.1 per cent of its total assets under management. For an exchange of Binance’s size, that outflow was presented as manageable, but it underlined how shaken customer confidence had been.
Why the Binance Hack Is Being Called the Biggest Ever
The numbers explain the superlative. At $6.3 billion or more, the Binance theft is more than four times the $1.5 billion stolen from the Bybit exchange in February 2025, an attack the FBI also attributed to TraderTraitor. It dwarfs the roughly $620 million stolen in the 2022 Ronin network theft, also linked by US authorities to North Korean hackers. Elliptic went further, calling it almost certainly the largest single theft of any kind in history, a claim that puts a crypto hack ahead of the most famous bank robberies and art heists ever recorded.
That comparison needs a note of caution. Calling something the largest theft ever depends on how you value the stolen assets, which cryptocurrencies can swing wildly in price, and on whether you count frozen funds that may eventually be recovered. What is not in doubt is that it is the largest cryptocurrency theft on record by a wide margin, and one of the largest cybercrime cases of any kind. The sheer speed also stunned investigators: emptying wallets across ten blockchains in roughly twenty minutes suggests careful planning, deep access, and a well-rehearsed exit plan.
The TraderTraitor name itself is worth understanding. It is the FBI’s label for a cluster of North Korean state-sponsored hackers known for targeting cryptocurrency firms, often through social engineering, fake job offers, and compromised devices. The group has previously been blamed for the Bybit theft and the DMM Bitcoin theft. Cybersecurity experts say these operations are unusually patient, sometimes spending months building trust with employees before striking, which is why a single compromised laptop can become the doorway to billions.
What Is Confirmed, What Is Alleged, and What Is Unknown
Confirmed: Binance’s hot wallets were compromised on October 29, 2026, for roughly $6.3 billion; withdrawals were paused and then reopened in phases; Binance covered the losses from company funds and reported about 95 per cent of affected assets replenished by November 1; stablecoin issuers froze a large portion of the stolen funds; and the FBI formally attributed the attack to North Korea’s TraderTraitor group on October 31. These points are supported by Binance’s own statements, the FBI alert, and multiple blockchain analytics firms.
Alleged but not yet proven in court: that North Korean state hackers personally carried out the attack, as opposed to the FBI’s attribution being based on technical indicators, wallet patterns and intelligence that has not been fully published. Attribution in cyber cases rests on patterns, code similarities, infrastructure reuse and intelligence assessments, and it is rarely accompanied by the kind of evidence a courtroom would demand at the moment of announcement. No individual hacker has been publicly charged in connection with this theft as of early November 2026, and North Korea has not confirmed any role.
Still unknown: the complete step-by-step method of the breach, beyond Binance’s account involving a compromised engineer laptop and other breaches; how much of the remaining unfrozen funds will ever be recovered; and whether the laundering attempts the FBI warned about will succeed through decentralised platforms. Crypto expert Ari Redbord has predicted the hackers will break the stolen assets into pieces and try to launder them through smaller exchanges over months, a process that could unfold slowly and in public view on the blockchain, even as the identities behind the wallets stay hidden.
- October 29, 2026: roughly $6.3 billion stolen from Binance hot wallets across ten or more blockchains.
- October 31, 2026: the FBI attributes the theft to North Korea’s TraderTraitor group.
- November 1, 2026: Binance says about 95 per cent of affected assets have been replenished and withdrawals reopen in phases.
- Frozen so far: roughly $2.85 billion to $3 billion, mostly in USDT and USDC stablecoins.
- Still at large: roughly $3.3 billion, with the FBI warning of conversion into Ethereum and laundering attempts.
What Happens Next for Crypto Users
For ordinary crypto users, the practical lessons are less about geopolitics and more about security habits. Keep only trading funds on an exchange, and move long-term holdings to a hardware wallet you control. Turn on every security feature your exchange offers, be suspicious of unexpected job offers, downloads and support messages, and remember that even employees of the world’s largest exchange can be targeted. If an offer or a link feels slightly off, it probably is, and that instinct is worth more than any antivirus software.
For the wider crypto industry, the Binance hack is a stress test. Exchanges will face fresh questions about how much they keep in hot wallets, how they vet employee devices, and how quickly they can freeze stolen funds with stablecoin issuers. Regulators will likely ask why a single breach could move billions in minutes, and whether the industry’s defences have kept pace with attackers who now operate at nation-state level. The answers will shape new rules, new insurance arrangements, and new security standards in the months ahead.
There is a broader curiosity angle too: this is a story where finance, technology, espionage and crime all collide, the kind of tale that travels fast because it sounds like a movie plot but is documented in FBI alerts and blockchain records. Readers who follow fast-moving power and secrecy stories may also want our reporting on the Pentagon UFO files and the triangular craft claims of 2026, and on how X suspended 13,000 accounts over foreign influence concerns ahead of the midterms, both stories where official claims, public evidence and unanswered questions sit side by side.
Key Takeaways
The FBI’s attribution gives this story its headline, but the deeper story is about scale and speed. A theft of more than $6 billion, executed in minutes, frozen in part within days, and covered by the victim company from its own funds, is unlike anything the crypto world has seen. Whether a court ever convicts anyone for it, the incident has already changed how exchanges, regulators and users think about security.
As with any fast-moving investigation, expect the numbers to be refined and the details to sharpen over the coming weeks. Binance has promised a full post-incident report, the FBI and its partners are still tracing funds, and blockchain analysts are publishing updates as wallets move. Until then, treat the FBI attribution as the official US government position, treat the exact breach mechanics as still emerging, and keep the most important fact in focus: billions were stolen in the Binance hack, much was frozen, and the hunt for the rest is only just beginning.
Frequently Asked Questions
How much was stolen from Binance?
Binance said approximately $6.3 billion was taken from its hot wallets on October 29, 2026. Blockchain firms Elliptic and TRM Labs estimated the total slightly higher, at $6.36 billion to $6.43 billion, across ten or more blockchains.
Who does the FBI blame for the theft?
The FBI blamed TraderTraitor, its name for a North Korean state-linked hacking operation, in an alert issued on October 31, 2026. The agency said it is working with the US Secret Service and IRS Criminal Investigation to track the stolen assets.
Is North Korea’s involvement proven?
The FBI attribution is the official US government assessment, but it is not a court conviction, and no individual has been publicly charged in this case as of early November 2026. President Donald Trump also said on October 31 that investigators were still learning about the case and that involvement was not yet certain.
Will Binance customers get their money back?
In response to the Binance hack, Binance said it set aside more than $6.34 billion of company funds to cover affected assets and reported about 95 per cent replenished by November 1, 2026, with withdrawals reopening in phases. Customers should follow Binance’s official updates for the status of their own accounts.
How much of the stolen crypto has been frozen?
Estimates vary by source and timing, but roughly $2.85 billion to $3 billion has been frozen or seized, mostly in USDT and USDC stablecoins, leaving roughly $3.3 billion still under the hackers’ control according to published reports.