.png "Global Insight")
Two days after the largest cryptocurrency theft in history, the United States has named the thief. On Saturday, October 31, the FBI said North Korea was responsible for stealing more than $6 billion from Binance, the world's largest cryptocurrency exchange — turning a chaotic $6.3 billion mystery into a state-sponsored hacking case with global consequences.
What the FBI actually said
In a cyber alert issued on October 31, the FBI said North Korea "was responsible for the theft of more than $6 billion USD in virtual assets" from Binance "on or about October 29, 2026," according to the Associated Press. The bureau attributed the attack to an operation it calls TraderTraitor, the same name it gave to the group behind the $1.5 billion Bybit theft in February 2025 — previously the largest crypto heist on record.
The FBI said it worked with the US Secret Service and IRS Criminal Investigation. Investigators have observed the stolen assets being converted primarily into Ethereum, and they expect the hackers to move the money again through decentralised finance platforms and "instant swap services". The bureau published wallet addresses linked to the theft and urged exchanges and crypto services to block transactions tied to them.
How the $6.3 billion heist unfolded
The theft happened on Thursday, October 29, when billions of dollars in cryptocurrency moved out of wallets linked to Binance within minutes. Blockchain intelligence firm TRM Labs estimated that about $6.36 billion was transferred across 10 blockchains, most of it in roughly 20 minutes, according to reports of its analysis.
When we covered the incident on October 30, the cause was still unconfirmed, Binance had not yet called it a hack, and only $2.54 billion had been verified as frozen. The FBI's announcement resolves the two biggest open questions from that first report: how much was taken, and who took it. What it does not resolve is the technical root cause — how the attackers got into the wallets — which Binance has still not explained in a full post-mortem.
What Binance has recovered — and what is still missing
Binance said on October 31 that it had replaced 90% of the stolen assets and had set aside more than $6.34 billion of company funds to cover the roughly $6.3 billion taken, pledging that customers will be fully reimbursed. About $3 billion in stolen assets had been frozen on-chain with law-enforcement help, and withdrawals paused after the attack were expected to restart within about 45 hours.
Those numbers deserve a careful reading. Money "frozen" is not the same as money returned: stablecoin issuers can block specific tokens from moving, but Bitcoin and ether have no central issuer that can freeze them. That is why the laundering route the FBI describes — conversion into ether, then through decentralised platforms — is the part investigators are racing to block.
Why this attribution matters beyond crypto
Attribution to North Korea puts this theft in a different category from an ordinary exchange hack. US officials have long accused Pyongyang of using crypto thefts to fund its weapons programmes, and the TraderTraitor label links this heist directly to the Bybit case — a pattern, not a one-off.
For ordinary users, the practical lesson is narrower. The incident moved whole markets — Bitcoin fell to a six-week low on October 29, amid wider tech weakness covered in our Alphabet earnings miss post — yet Binance customers are, on the company's word, covered. The risk now sits with crypto's plumbing: billions can move in 20 minutes, but stopping the money afterwards depends on hundreds of independent firms all honouring the same blocklist at once.
The next milestones are concrete: whether platforms actually block the listed addresses, whether more stolen ether is frozen before it is swapped away, and whether Binance publishes the post-mortem explaining how the wallets were breached. The FBI has answered who did it; how it was done, and how much can truly be recovered, are still open.