FBI Attributes Binance Theft to North Korean TraderTraitor, Lists ETH Addresses to Block
By Crypto Wire
October 31, 2026
The FBI issued a dated cyber alert on October 31, 2026 attributing the theft of more than $6 billion in virtual assets from Binance on or about October 29 to North Korean actors it tracks as TraderTraitor — the first U.S. government attribution primary on this incident for the Orange County desk. That is the new fact beyond Saturday’s ~90% covered / Oct. 31 PoR snapshot chapter: not another replenishment recycle, but a named DPRK cluster with an official block-list ask. Prefer the FBI alert text over social posts that still treat North Korea as only a TRM Labs tip.
What the bureau and partners say they saw. Working with the U.S. Secret Service and IRS Criminal Investigation, the FBI says TraderTraitor actors were observed converting stolen assets primarily into Ethereum, and that those holdings are expected to move through DeFi and instant-swap rails in further laundering stages. The alert urges THORNode operators, RPC operators, instant exchanges, DeFi services, analytics firms, and other VASPs to block transactions with or derived from a published list of ETH addresses the bureau ties to the cluster. Treat that list as a live compliance filter, not a claim every stolen unit already sits in those wallets.
How this sits on Binance’s own recovery clock. Binance’s Saturday update still puts covered share near 90%, names ten major assets as 100% backed on the reserves surface, and keeps a November 1 withdrawal reopen as the next operational milestone subject to security checks — with the full zero-knowledge PoR pack still aimed around November 3 after the 00:00 UTC October 31 snapshot. Attribution does not reopen withdrawals by itself; it changes who the desk names as the adversary while users wait for the phased restart print.
Context without rewriting closed beats. TRM Labs had already pointed the ~$6.36 billion theft at TraderTraitor before the FBI alert; the bureau’s language now matches that industry call with a public address set. Earlier Binance chapters still describe a complex DevOps / malicious-software path rather than a leaked hot-wallet private key, and industry freezes near $3 billion remain the last hard recovery-dollar print — separate from the exchange’s treasury/SAFU/futures-fund cover of customer balances. Do not invent a recovered-from-attacker percentage from the covered-share claim.
What this piece will not invent: a live withdrawal reopen timestamp, a finished zk-PoR download, or a claim that every ETH hop on the FBI list is already frozen. Prefer the October 31 FBI alert and Binance’s own Saturday cover/PoR language over screenshots that collapse attribution into “funds recovered.”
What to watch on-chain next: Track the FBI-listed TraderTraitor ETH addresses for DeFi and instant-swap hops, any exchange or bridge freeze notices that cite those wallets, and Binance’s next print that either confirms a phased November 1 withdrawal restore or slips the clock past the security-check gate.
Bottom line: The FBI’s October 31 alert names North Korean TraderTraitor for the ~$6B+ Binance theft and publishes ETH laundering addresses to block — while Binance’s own desk still holds ~90% cover and a November 1 withdrawal target subject to security checks.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
