The FBI has publicly attributed the theft of more than $6 billion from Binance to North Korean activity it calls TraderTraitor. Binance thanked the agency on November 1, sharing its assessment as the exchange continues its operational recovery.
An agency assessment enters the public record
The FBI advisory, dated October 31, places the theft on or about October 29. It says investigators working with the Secret Service and IRS Criminal Investigation observed stolen assets being converted mainly into ether.
The bureau anticipates additional laundering through decentralized-finance and instant-swap services. That passage is a forecast of subsequent activity, rather than confirmation that every predicted transaction has occurred.
Tracing and disruption
The advisory provides addresses associated with the theft and asks infrastructure operators, exchanges, analytics firms and other service providers to block transactions involving those addresses or funds derived from them. Readers seeking the identifiers should consult the original notice rather than copied lists.
What changes for readers
This supplies an attributable US agency finding after Trump’s October 30 remarks left responsibility open. The chronology matters: the president’s earlier uncertainty and the FBI’s later announcement describe different points in the investigation.
Responsibility, restoration and repayment still require different evidence. An attribution statement cannot show that stolen assets have returned to customers or that a specific withdrawal route is usable. Binance’s separate phase-one withdrawal plan targets November 1, 06:00–09:00 UTC; that plan should not be read as a completed restart.
Our guides explain how to verify primary-source claims and how to assess recovery scams.
Source check: November 1, 2026, 05:16 UTC. Attribution and tracing observations are the FBI’s assessment; The Token Press has not independently reconstructed the intrusion.