FBI Ties North Korea to Binance’s $6 Billion Theft—and Asks DeFi to Block the Money Trail

The FBI has put a name behind the biggest crypto theft of the year: North Korea.

In an official cyber alert, the bureau said North Korean actors stole more than $6 billion in virtual assets from Binance on or about October 29. The FBI tracks this branch of North Korean cyber activity under the name “TraderTraitor.”

That finding changes the story. This is no longer only an exchange-security disaster or a fight over reimbursement.

It is now an active sanctions, laundering and infrastructure problem touching Ethereum, DeFi services, instant-swap providers and the companies that monitor blockchain activity.

The FBI said it has observed the actors converting stolen assets primarily into Ether. Investigators expect the funds to move through additional DeFi and instant-swap services as the group tries to put more distance between the theft and whatever comes next.

The bureau published a long list of Ethereum addresses. It urged THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual-asset providers to block transactions involving funds tied to them.

That request is the real pressure point. Public blockchains make the money trail visible, but visibility alone does not freeze an asset.

The freeze happens when exchanges, token issuers, infrastructure providers and service operators decide—or are legally compelled—not to process it.

Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.

The company has already publicly committed to cover losses through… pic.twitter.com/UqtBd37Fpj

— Binance (@binance) October 30, 2026

Binance has said it is working with law enforcement, issuers, blockchain-intelligence firms and other industry partners to trace and recover assets. That coordination matters because stolen tokens can cross protocols far faster than a conventional bank transfer can move through the correspondent system.

🚨 UPDATE: Binance is working with the FBI and other law enforcement agencies to recover stolen funds, while $3B has already been frozen.https://t.co/IoqAEalKeI

— Cointelegraph (@Cointelegraph) October 30, 2026

CoinDesk places the FBI alert inside the wider recovery effort, where Binance, law enforcement, issuers and blockchain-intelligence firms are trying to trace funds while the attackers move primarily into Ether and prepare additional laundering stages. The request reaches well beyond centralized exchanges because THORNode operators, RPC providers, instant-swap services, DeFi front ends and analytics companies can each see or interrupt a different part of the route before the assets are split across more addresses, swapped into new tokens or pushed toward services with weaker controls.

There is still a hard limit to public coordination because a permissionless protocol cannot freeze an account. Many of the services around it can.

Front ends, hosted nodes, bridges, stablecoin issuers, custodians and exchanges can all become choke points.

The FBI’s address list gives those companies a concrete screening target, but speed will decide how much value remains within reach.

The next phase will show how much of the stolen value can actually be immobilized. The addresses are public and the FBI’s finding is official.

Now the market will see whether the crypto industry can turn those facts into recovery before TraderTraitor turns the assets into something harder to follow.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.