Binance hack: FBI blames North Korea's TraderTraitor, flags 600-plus wallets

The US Federal Bureau of Investigation (FBI) has publicly blamed North Korea for the theft of more than $6 billion in cryptocurrency from the exchange Binance, naming the hacking activity it calls "TraderTraitor" as responsible. In an alert published this week, the FBI, working with the US Secret Service and the tax agency's criminal investigation unit, said the attackers were converting stolen assets mainly into Ether and asked exchanges and other crypto services to block transactions linked to more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address. Binance said on Saturday, October 31, 2026, that it had replenished 90% of the stolen funds and planned to resume customer withdrawals on Sunday, November 1.

When the hack was first disclosed on October 29, Binance said it would cover users' losses but did not name an attacker, and reports only mentioned suspected links to North Korea. The FBI's alert turns that suspicion into an official US government attribution. It matters for three reasons.

First, it shapes the chase for the money. By publishing hundreds of wallet addresses and asking the industry to block them, the FBI is trying to make the stolen funds harder to cash out. Every exchange or service that refuses those transactions shrinks the routes the hackers can use. The fact that the stolen assets are being converted into Ether shows how attackers try to move funds through large, liquid markets before they are frozen.

Second, it shows how much of today's crypto crime is driven by state-linked groups. North Korea has been accused by the United States of running hacking operations to raise money, and this attribution adds what reports describe as the largest crypto theft on record to that list. For ordinary users, it is a reminder that the biggest threats to exchanges are not small-time scammers but well-resourced professional teams that target staff, devices and software.

Third, it affects how users should think about where they keep crypto. Binance's promise to cover losses, and its report that 90% of the funds have been replenished, will reassure many customers. But the episode shows that even the largest exchange can be breached, and that customers depend on the exchange's own reserves and goodwill when things go wrong.

For young Indians who trade or hold crypto, the practical lessons are simple: turn on every security feature the exchange offers, be wary of messages or links claiming to help "recover" funds after a hack, since scammers often exploit big incidents, and avoid keeping more on any single platform than you can afford to have frozen for days.

Short-term: Users will watch whether withdrawals resume on schedule. Exchanges and crypto services that act on the FBI's list may freeze funds linked to the flagged addresses, which could slow the hackers' attempts to cash out.

Long-term: The attribution is likely to add pressure on exchanges to tighten internal security, especially around staff devices and withdrawal systems, and on regulators to demand stronger safeguards for customer funds.

Who is affected: Binance users worldwide, including in India; other exchanges and DeFi services asked to block the flagged addresses; blockchain analysts tracking the funds; and law-enforcement agencies pursuing the money.

Questions and Answers