FBI says North Korea stole $6bn from Binance
The FBI blames North Korea's TraderTraitor group for the Binance theft, and the exchange has reopened withdrawals after billions left the platform.
The facts
- According to Decrypt, the FBI said North Korea's TraderTraitor group stole more than $6 billion from Binance on or about October 29, 2026. It published hundreds of Ethereum addresses, 19 Bitcoin addresses and one Solana address linked to the theft.
- Chainalysis said the hackers moved more than $500 million on Tron, and funds are now leaving through cross-chain services including Chainflip, Relay, THORChain and NEAR. The launderers have started moving onto Solana.
- Binance said it processed $4.649 billion in withdrawals and $1.01 billion in deposits in the first nine and a half hours of reopening, a net outflow of about $3.64 billion, or 2.1% of the $171 billion in assets in its October 28 proof of reserves.
- CEO Richard Teng said Binance has replenished approximately 95% of the affected assets and will absorb the loss rather than users. Reuters reported that Circle froze more than $1.1 billion in USDC.
Case notes · Danny's take
Why it matters
A hack this size is not only a theft. It is a live test of whether an exchange can lose billions and still hold its users' trust. The first answer is in the numbers: a 2.1% net outflow after reopening is a stress test, and Binance passed that first round. The laundering is the second story. The money is being split across chains and swap services, and that is where the evidence trail gets harder to follow. It is also a reminder that you are trusting a company's balance sheet every time you leave funds on an exchange.
For traders
Don't trade the headline. Watch the updated proof of reserves Binance expects to publish, and treat DefiLlama wallet figures carefully, since they can include transfers between Binance's own wallets. Also watch exchange flows, such as the inflows OKX and Bybit recorded, and Chainalysis updates on where the stolen funds go next. If you use leverage on news candles, size down.
For builders
The FBI has asked node operators, instant exchanges, DeFi services and analytics firms to block the listed addresses. If you run a swap, bridge or wallet product, check that your address screening can ingest lists like this quickly. Cross-chain services are named as the laundering route, so expect more pressure on them.
Not financial advice. Do your own investigation.
This story was summarised with AI from Decrypt's reporting and checked against our editorial policy. Danny's take reflects his views. Disclaimer.
Danny Walter
Founder of Moon Republic, Volt Terminal and Moon Republic Academy. Author of The Market Is a Crime Scene and After the Applause.