The FBI names North Korea
The Federal Bureau of Investigation says the Democratic People's Republic of Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026.
The bureau identifies the specific North Korean malicious cyber activity as TraderTraitor. That is the same name the FBI used for the state-linked cluster it blamed for the $1.5 billion Bybit theft in February 2025.
The statement turns what had been a high-confidence private-sector assessment into a formal US law-enforcement attribution. Blockchain-intelligence firms had already linked the Binance operation to TraderTraitor through on-chain and off-chain evidence.
What the attribution establishes and what remains unresolved
The FBI's finding identifies the actor behind the operation. It does not by itself reconcile the final loss, determine how much will be recovered or replace Binance's promised technical post-mortem.
Binance currently estimates that approximately $6.3 billion was affected and says roughly $3 billion has been frozen. The exchange also says it has replenished more than $5 billion in matching assets (about 80% of the stolen total) and prepared more than $6.34 billion in company funds for the response.
Those figures describe different parts of the recovery and should not be added together as if all were recovered cash. Frozen assets remain subject to verification and legal recovery, while replenishment is Binance's replacement of the affected tokens with company-funded assets.
Why TraderTraitor matters
TraderTraitor is associated with North Korean operations targeting cryptocurrency companies through tailored social engineering, compromised development environments and abuse of trusted access. The FBI's attribution does not yet disclose the specific evidence it used in this case.
Binance initially pointed to a compromised DevOps laptop and later said investigators found additional breach points. It has reported no evidence that wallet private keys were leaked. A private key can remain secret while attackers misuse credentials, software or an authorized signing service, so the final technical explanation still matters.
What comes next
The key unresolved questions are:
- which systems and credentials were compromised;
- how the attackers bypassed withdrawal controls across multiple networks;
- how much of the frozen total is ultimately recovered;
- whether withdrawals resume within Binance's announced window;
- and whether the final reconciled loss remains near $6.3 billion.
The precise position is now: the FBI attributes the more-than-$6-billion Binance theft to North Korea's TraderTraitor activity, while Binance's final technical report and recovery accounting remain pending.
Follow Signal21's complete Binance incident timeline and the latest update on asset replenishment and withdrawal restoration.
This is a developing story. Signal21 will update the coverage when the FBI or Binance publishes additional technical indicators.