FBI cyber alert October 31, 2026; theft on or about October 29, 2026
FBI Attributes the Record Binance Theft to North Korea TraderTraitor and Publishes Addresses to Block
The FBI confirmed on October 31 that North Korea TraderTraitor group was behind the theft of more than $6 billion in virtual assets from Binance, the largest cryptocurrency exchange theft on record, which took place on or about October 29. The Bureau, working with the U.S. Secret Service and IRS Criminal Investigation, said the actors have been converting the stolen funds mainly into ether and expects them to keep laundering through swap services and other decentralized finance tools. The alert listed over 600 Ethereum addresses, just under 20 Bitcoin addresses and a single Solana address that hold or once held funds from the hack, and urged node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions with or derived from those addresses. Chainalysis said the attackers have already used thousands of addresses and that it expects tens of thousands in the coming weeks as the laundering network widens, using automated mechanisms to circulate funds between addresses. Stablecoin issuers froze over $2.4 billion of the stolen funds. Binance said it had replenished about 90 percent of the stolen assets and planned to resume customer withdrawals on Sunday, November 1. TraderTraitor is tracked as a subunit of the Lazarus Group, the same activity the FBI previously attributed the roughly $1.5 billion Bybit theft of February 2025 to.
Executives
Scale is the first fact: one theft above $6 billion, larger than every prior exchange hack, executed against the largest exchange in the sector. The second fact is the response model: law enforcement published the laundering addresses publicly and asked the whole ecosystem to block them, which makes screening a shared duty rather than one firm problem. Any organization that holds or moves crypto assets should be able to say today whether the FBI list is loaded into its screening.
CIO / CISO
Ingest the FBI address list, over 600 Ethereum addresses plus the Bitcoin and Solana entries, into wallet screening and transaction monitoring now, and expect the list to grow: Chainalysis already counts thousands of addresses in use and projects tens of thousands. Screen for transactions derived from listed addresses, not only direct transfers, per the alert wording. Binance preliminary account pointed to an initial compromise involving a DevOps engineer laptop, so review privileged workstation controls for anyone with production or wallet-adjacent access.
Engineers
Automate the blocklist update rather than pasting addresses once, because the laundering pattern described is automated circulation between addresses before onward movement. Log and alert on near matches and peel-chain patterns your analytics provider flags, and preserve any hit with full transaction context for a report to the FBI Internet Crime Complaint Center, which the alert names as a reporting channel.
Everyone (non-IT)
If you hold assets on any exchange, nothing in the FBI alert asks you to move funds or change passwords. Binance said it replenished about 90 percent of stolen assets and planned to resume withdrawals on November 1. Treat urgent messages claiming to be from an exchange about this hack with suspicion and reach the service only through its official app or site, because large public incidents reliably attract impersonation attempts.