The US Federal Bureau of Investigation has confirmed that North Korea's TraderTraitor hacking group was behind the theft of more than $6 billion in virtual assets from Binance, the world's largest cryptocurrency exchange, on or about October 29, according to the FBI statement reported by CoinDesk on Saturday night. It is the first official law-enforcement attribution of what analysts say is the largest crypto theft in history — a major new development after the heist itself, which Awaaz Punjab reported on October 29-30, and Binance's subsequent announcement that it had replaced about 90 percent of the stolen funds.

Source: CoinDesk, Oct 31, 2026

Yaani: Binance has put the total impact at about $6.3 billion — about $630 crore, or roughly 63,000 lakh dollars. Blockchain analytics firm TRM Labs estimated about $6.36 billion was moved out of Binance wallets across ten blockchains, most of it in about 20 minutes. About half of the stolen assets were stablecoins that issuers including Tether, Circle and Ripple have since frozen, according to earlier Reuters reporting on the heist.

In its Saturday statement, the FBI said it is working with the US Secret Service and the IRS Criminal Investigation division, and that the three agencies have observed TraderTraitor actors converting the stolen assets mainly into ether. They expect the funds to be laundered further through decentralised finance (DeFi) services and instant swap services. 'FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets,' the statement said, as quoted by CoinDesk.

Source: Bloomberg via TradingView, Oct 31-Nov 1, 2026

The FBI published the addresses it wants blocked: more than 600 Ethereum addresses, just under 20 Bitcoin addresses and a single Solana address that it said currently hold, or at some point held, funds from the hack, CoinDesk reported. Blockchain analytics firm Chainalysis said it expects 'tens of thousands' of crypto addresses to be used in the coming weeks as the attackers continue laundering the stolen funds.

The attribution follows the same pattern as an earlier record theft: the FBI previously identified TraderTraitor as the group behind last year's roughly $1.5 billion hack of the exchange Bybit, and US blockchain analysis firms TRM Labs and Chainalysis had already linked the Binance attack to North Korea on the basis of on-chain and off-chain intelligence, according to Reuters. North Korea routinely denies involvement in cyberattacks and cryptocurrency thefts, and it has not publicly responded to the FBI statement in the reports reviewed. Binance has said it will cover customer losses; it first pointed to a compromised employee laptop and later said investigators had found additional points of breach, with no evidence that wallet private keys had leaked.

Source: NPR explainer, Oct 31, 2026

What happens next is a race between laundering and freezing: the more of the ether and other assets that exchanges, node operators and stablecoin issuers block at the published addresses, the less of the record haul the attackers can turn into usable cash. The FBI has not released a full public account of the evidence behind its attribution, and no court judgment identifying individual perpetrators has been reported.