FBI Attributes $6 Billion Binance Crypto Theft to North Korea as Exchange Replenishes 95% of Stolen Assets

The Federal Bureau of Investigation (FBI) has attributed the theft of more than US$6 billion in virtual assets from cryptocurrency exchange Binance to North Korea, identifying the cyber activity as TraderTraitor. The theft took place on or around October 29, 2026.

According to the FBI, the attackers have been converting the stolen assets primarily into Ethereum (ETH). Investigators expect the funds to move through decentralised finance (DeFi) platforms and instant-swap services as the attackers attempt to conceal their origins and prepare them for further laundering. Days earlier, OFAC also targeted networks accused of using fake identities, cryptocurrency, and money laundering to fund North Korea’s weapons programmes.

The FBI, working with the U.S. Secret Service and the Internal Revenue Service Criminal Investigation division, has published cryptocurrency wallet addresses connected to the stolen assets. It has urged private-sector organisations, including blockchain analytics firms, DeFi services, instant exchanges, node operators, and other VASPs, to block transactions involving these addresses or funds derived from them.

Binance’s response and recovery efforts

Binance has said it will absorb the financial impact of the incident rather than pass the losses on to customers. In its October 31 recovery update, the exchange reported that it had replenished approximately 90% of the affected assets. It had set aside more than US$6.34 billion in company funds to cover the losses.

The recovery involved resources from Binance’s corporate treasury, its Secure Asset Fund for Users (SAFU), and a portion of its Futures insurance fund. The exchange also confirmed that it was purchasing the remaining affected tokens through market and over-the-counter channels. It said the outstanding assets were less liquid and would take longer to source.

On November 1, Binance announced that it was resuming withdrawals in phases after conducting security assessments and checking the readiness of affected services. The exchange also reported that it had increased the covered amount to approximately 95% of the affected assets. It said balances in ten major cryptocurrencies, including Bitcoin, Ethereum, USDT, BNB, and USDC, were fully backed.

Latest developments

Reuters reported on November 2 that Binance customers had withdrawn a net US$3.64 billion, equivalent to 2.1% of the exchange’s assets, as services returned. Binance said withdrawals were stabilising and deposits remained substantial.

The exchange has also committed to publishing a post-incident report once its investigation is complete. Meanwhile, the FBI’s warning puts the wider cryptocurrency industry on alert, as stolen funds may continue moving through multiple services and blockchain networks. 

Implications for compliance teams

The incident highlights how stolen cryptocurrency can move rapidly across wallets, exchanges, and decentralised services. It also shows why financial institutions and VASPs need controls that can identify suspicious fund movements beyond their immediate platforms.

Compliance teams should focus on:

• Wallet screening: Monitor wallet addresses identified by law enforcement and assess exposure to funds linked to the theft.
• Transaction monitoring: Identify rapid transfers, unusual conversion patterns, and movements through multiple wallets or services.
• Cross-platform cooperation: Share relevant intelligence with blockchain analytics providers, exchanges, and law enforcement where legally appropriate.
• Source-of-funds checks: Investigate customers depositing or transferring assets with links to known theft-related addresses.
• Incident preparedness: Maintain clear procedures for freezing or restricting suspicious activity, escalating alerts, and responding to law-enforcement requests.

The case reinforces an important point that cryptocurrency transactions may be traceable on public blockchains, but tracing funds is not the same as stopping them. Effective AML controls depend on timely intelligence sharing and the ability of exchanges and other VASPs to act before stolen assets are moved further through the financial system.