FBI blames North Korea's TraderTraitor for $6B Binance hack

The FBI on Oct. 31 formally tied the Binance hack, put at roughly $6 billion, to North Korea's TraderTraitor group. According to CryptoSlate, the bureau, working with the US Secret Service and IRS Criminal Investigation, published hundreds of addresses linked to the theft and asked THORNode operators, RPC providers, DeFi platforms and exchanges to block transactions involving them.

Details

The attack on Binance's hot wallets took place on Oct. 29. Estimates of the total differ: Crypto Briefing cites $6 billion, while TRM Labs, which pointed to North Korea, puts it at $6.36 billion. Crypto Briefing notes the FBI tied the same group to the $1.5 billion Bybit theft in 2025.

CryptoSlate reports that about $3 billion of the stolen assets has been restricted through stablecoin freezes. Chainalysis described a laundering route in which hackers use DeFi lending protocols on Tron to get around stablecoin freezes. The outlet also says the hackers lost about $119 million on rushed trades.

THORChain co-founder Chad Barraford rejected the request, saying the protocol is permissionless and cannot selectively censor transactions. He said node operators hold only public real-time data and that "no subpoenas required" is a best-case scenario for investigators. We could not open the FBI's own alert automatically, so the details here come from media reports.

What this means for the market

An official attribution raises pressure on venues that stolen funds could pass through: exchanges are expected to block, while decentralized protocols face a choice between neutrality and helping investigators. THORChain's stance shows DeFi has no single answer.

For Binance users the main question is the restoration of services; see our note on the phased resumption of withdrawals, and follow the investigation in the hack timeline. For the live bitcoin price, see the daily brief.