The US Federal Bureau of Investigation said on October 31 that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on October 29. It is the first official attribution for the largest hack in crypto history, after days of independent analysts pointing at the same group. The FBI calls the activity TraderTraitor, a unit it places under the Lazarus Group umbrella.
What the FBI is asking the crypto industry to do
The FBI did not make the announcement alone. Together with the US Secret Service and IRS Criminal Investigation, it asked THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset providers to block transactions coming from the addresses it published. Per CoinDesk's reporting of the announcement, the list runs to more than 600 Ethereum addresses, just under 20 Bitcoin addresses, and a single Solana address.
The reason is practical. The FBI says the attackers have converted most of the stolen funds into ether and are expected to keep laundering them through DeFi platforms and instant swap services. Chainalysis adds that tens of thousands of new addresses are likely to appear over the coming weeks as that laundering runs its course. One distinction matters here: blocking is not recovery. A blocked address does not send money back to victims on its own.
The nuance worth keeping
US President Donald Trump, asked by reporters on Saturday night, sounded less certain than the FBI. "We're learning about it," he said. "We don't know if it's North Korea." That does not cancel the FBI's attribution, but it shows the political story is not as clean as the investigators' file. We print both as they stand, because readers deserve to know which is a law enforcement statement and which is a political comment.
This is not TraderTraitor's first FBI notice. The roughly $1.5 billion theft from Bybit in February 2025 was also linked to the group. The pattern repeats, and that is what makes this warning more than a list of addresses.
Still to come
Two items from the Binance sequence are still hanging this morning. First, the phased withdrawal reopening targeted for November 1. As of writing, Binance has not confirmed that withdrawals have actually reopened. Second, the full cryptographic proof of reserves promised for November 3. The details of the 90% asset replacement are in our earlier article, and the full hack timeline is in the October 31 article.
One last warning. Every official announcement like this is followed by fake pages posing as the FBI or Binance and offering refunds. The FBI never asks for a seed phrase, and its reporting channel is ic3.gov. Anyone asking for a deposit to unblock funds is running a scam.
Sources: FBI statement (Oct 31, 2026) via CoinDesk (Oct 31, 2026), Associated Press (Oct 31, 2026), Bitcoin.com (Oct 31, 2026), Coin Edition (Nov 1, 2026). Figures are snapshots at writing time, morning November 1, 2026 WIB, and can change.
Writing about crypto and Super Intelligence: market news, new projects, Super Intelligence models, and early opportunities like airdrops and testnets. Every piece starts from the official announcement, with the costs worked out up front.