Cyber — 2026-10-31

North Korean Hackers Steal More Than 6 Billion Dollars From Binance in Largest Crypto Heist

BLUFGiven converging private-sector attribution to TraderTraitor and the FBI's established precedent after Bybit, the bureau will likely publicly name North Korea for the Binance theft by late November.

Blockchain firm TRM Labs reported that an attacker moved about $6.36 billion out of Binance wallets across 10 blockchains on Thursday, most of it in roughly 20 minutes, and attributed the theft with "high confidence" to North Korea's TraderTraitor unit 123. Chainalysis also expressed high confidence in the attribution, per CNN 4. Binance said about $3 billion has been frozen, including more than $2.3 billion by Tether and Circle, and that its investigation has not attributed responsibility to any individual 24. Binance said the breach began with an engineer's laptop, though on Friday it reported "additional points of breach" 23. The FBI said it is engaged with public and private partners but did not name North Korea 3; Binance said withdrawals should resume within 45 hours 2.

Analysis
Confidence is high, resting on consistent reporting from four outlets and the bureau's earlier attribution of the Bybit theft to the same unit. The independent evidence is thinner than that count suggests, since Al Jazeera, CNN and Nextgov/FCW lean on the same blockchain-analytics firms and Binance statements, leaving Foreign Policy as the primary account. The FBI or another US government agency will likely publicly attribute the Binance theft to North Korea between November 1 and November 21, 2026. TRM Labs and Chainalysis already agree, so a government statement would formalize an existing judgment rather than establish a new one. Washington may still withhold it while the investigation runs and peace-talk and sanctions diplomacy continue, leaving attribution to private firms. Binance's "additional points of breach" and the roughly $2.4 billion beyond issuer reach mean laundering networks, not attribution, now decide whether recovery continues. Attribution would let Treasury and Justice move toward sanctions and forfeiture and give exchanges legal cover to block related transfers. Without it, compliance teams rely on private attribution, and exchanges and issuers should expect FBI wallet-blocking requests like those after Bybit.

4 sources

The World's Biggest Crypto Heist - Foreign Policy
Binance says $6.3bn stolen in biggest crypto heist in history: What we know - Al Jazeera
FBI is involved in response to $6.3 billion Binance hack linked to North Korea - Nextgov/FCW
Binance crypto hack: North Korea suspected to be behind biggest-ever heist - CNN