On November 1, 2026, Beijing time, the Federal Bureau of Investigation (FBI) issued a cybersecurity alert attributing a virtual asset theft exceeding $6 billion to North Korea, occurring around October 29 at Binance. The alert designated this type of activity as 'TraderTraitor' and requested relevant industries to block transactions associated with the listed addresses or derived from them. This record represents the public attribution by U.S. law enforcement agencies, not a court judgment, criminal charges against individuals, or newly announced sanctions; the alert also did not declare that asset recovery has been completed.
Law Enforcement Attribution and Blocking Request
The FBI stated that it, together with the U.S. Secret Service and the Internal Revenue Service Criminal Investigation Division, had observed the subsequent flow of stolen assets. The collaborative entities named in the alert include THORNode operators, RPC node operators, instant exchange platforms, decentralized financial services, blockchain analysis companies, and other virtual asset service providers, all of which were requested to block related money laundering transactions. The FBI simultaneously published a list of addresses; this article does not reproduce these actionable data; the alert also did not indicate whether various service providers have completed blocking or freezing.
According to the FBI alert, the TraderTraitor actors are currently primarily converting stolen assets into Ethereum, and law enforcement agencies expect to continue using decentralized finance and instant exchange services for further laundering. The public alert did not disclose the evidence and analytical methods used for attribution, nor did it provide a complete intrusion path, arrest information, or the total amount of recovered assets. Therefore, what the alert can confirm is the conclusion and blocking request of law enforcement agencies, but cannot fill in unpublicized investigative details.
Loss Assessment and Attack Path
Binance stated in its second official update that its hot wallets were compromised around 20:05 UTC on October 29, resulting in losses of approximately $6.3 billion worth of token assets. The FBI used the wording 'more than $6 billion,' while Binance provided the figure 'approximately $6.3 billion.' These two figures should be attributed to their respective sources and cannot be consolidated into a single audited precise total. Virtual asset valuations also fluctuate with the timing of measurement, and the current materials do not provide a unified independent valuation.
Binance initially stated that the incident may have involved a compromised laptop belonging to a DevOps engineer, which allowed attackers to gain access to a service container and submit unauthorized withdrawal transactions. The company later added that investigations revealed additional entry points, and no evidence of wallet private key leakage was found at the time. The complete attack sequence, all entry paths, and permission changes at each step remain undisclosed. The provided materials also do not identify a single physical intrusion location, and a detailed technical post-mortem is yet to be released, so the laptop hypothesis cannot be written as the sole or final cause.
Frozen Assets and Coverage Progress
Binance reported in its update on October 30 that approximately $3 billion in related assets had been frozen on-chain, stating that it would cover all stolen asset losses through the Secure Asset Fund for Users and company funds. The freezing of assets does not equal the return of assets or full compensation of losses, as no independent recovery audit has been provided by existing sources, nor is it explained how much of the frozen portion has actually returned to Binance's control. The company was still working with law enforcement agencies, blockchain analysis firms, token issuers, and other trading platforms to track the funds, with complete disposition results yet to be announced.
On October 31, Binance further stated that it had set aside over $6.34 billion in company funds and increased the replenishment ratio for affected assets from approximately 80% to 90%. The ten assets listed by the company—Bitcoin, Ethereum, Tether, BNB, Solana, USDC, XRP, USD1, RLUSD, and ZEC—had reached 100% reserve coverage. The remaining 10% still needed to be purchased through market and over-the-counter channels; the phased replenishment therefore cannot be described as all losses having been recovered or all affected assets having been restored.
Reserve Plan and Verification Scope
Binance stated that this round of replenishment utilized partial user security asset funds, futures insurance funds, and company-owned capital, and has completed the new reserve proof snapshot. The company estimates that generating the corresponding zero-knowledge proof will require approximately 40 to 50 hours; it also designated November 1st as the planned time for resuming withdrawals. These reserves and timelines are based on Binance's announcement, and the current materials do not contain independent audit conclusions or confirmation that withdrawals have actually been restored. The plan objectives cannot be written in completed operational status.
Associated Press published primary media metadata recording the same progress at 23:03:10 on October 31st, with both headline and brief summary pointing to the FBI's attribution of North Korean hackers and describing the incident as the largest cryptocurrency theft. This article only uses its headline, summary, time, and link for independent media verification, without utilizing the media's full text or images, nor does it present the company's statements as audited and confirmed facts. The current stage still lacks judicial rulings, complete technical pathways, full recovery proofs, and independent reserve verification, and the report does not provide cryptocurrency price assessments or trading recommendations.