The FBI said on 31 October that North Korea was responsible for the theft of “more than $6 billion USD in virtual assets” from Binance “on or about October 29, 2026”, naming the activity “TraderTraitor”.
The alert came two days after the theft began, by our arithmetic; for the $1.5 billion Bybit hack in February 2025, the FBI’s attribution came five days after the theft. It lists 628 addresses, by our count: 608 on Ethereum, 19 on Bitcoin and 1 on Solana.
Short explainer · FBI ties $6B Binance hack to North Korea in 2 days
A vertical news Short summarising this story. Figures come from the FBI alert, TRM Labs and NBC News/Reuters; our arithmetic is labelled.
Business Pill · Least Privilege
An evergreen Business Engineer explainer on least-privilege access. It explains the general idea only and does not discuss Binance or the FBI alert.
The key insight: As we read the alert, the FBI moved from attribution to action in one document: it names TraderTraitor for the Binance theft two days after it began, by our arithmetic, and hands the industry 628 addresses to block.
The alert says the FBI, “together with partners at the USSS and IRS-CI”, has observed TraderTraitor actors “converting stolen assets primarily into Ethereum (ETH)”.
It expects the assets to be laundered further “using DeFi and instant swap services”. It urges “THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms” and other providers to “block transactions with or derived from addresses” the group is using.
Days from the start of each theft to the FBI’s public attribution to North Korea’s TraderTraitor. Binance: theft began 29 October 2026 at 20:05 UTC (TRM Labs), FBI alert dated 31 October 2026. Bybit: hack reported 21 February 2025, FBI statement 26 February 2025 (NBC News/Reuters). Day counts are our arithmetic.
How It Matches TRM’s Attribution
Blockchain analytics firm TRM Labs had already attributed the attack to TraderTraitor, writing “We make this judgment with high confidence”. TRM put the total at approximately USD 6.36 billion moved out of Binance wallets on ten blockchains, starting at 20:05 UTC on 29 October.
TRM counted roughly USD 2.7 billion frozen onchain, about 42% of the total by our arithmetic. Our earlier piece on the theft, Binance Hack Moves $6.36B, carries those figures.
The Bybit Precedent
The FBI used the same name for the February 2025 Bybit theft. NBC News, carrying Reuters, reported that “The FBI said on Wednesday that North Korea was responsible” for that theft, five days after the hack was first reported.
The Business Lever: Exchanges Now Have an Official Block List
An FBI attribution with a published address list gives exchanges, payment firms and analytics companies an official reference for screening and freezing. The alert asks them to block flows tied to the listed addresses, 628 by our count; how much more can be frozen depends on how fast the assets move.
The Structural Read
As we read the dates, the official attribution came faster than for Bybit: two days after the Binance theft began against five days in February 2025, by our arithmetic.
As we read the FBI and TRM side by side, the government and the private tracer reached the same group name, and TRM had published its own attribution, with high confidence, a day earlier.
As we read the address list, almost all of it sits on Ethereum, 608 of 628 by our count, which matches the alert’s statement that the actors are converting stolen assets primarily into Ethereum.
FBI cyber alert, 31 October 2026
“block transactions with or derived from addresses”
Three Implications
FOR EXCHANGES AND SWAP SERVICES The FBI, USSS and IRS-CI ask instant exchanges, DeFi services and node operators by name to block flows tied to the listed addresses.
FOR BINANCE TRM counted roughly USD 2.7 billion frozen onchain, about 42% of the USD 6.36 billion it traced, by our arithmetic; the alert gives no frozen amount.
FOR ANALYTICS FIRMS The FBI’s group name matches the one TRM gave a day earlier, and the alert lists blockchain analytics firms among those asked to block the addresses.
The alert gives no exact total beyond “more than $6 billion”, no description of how Binance’s systems were breached and no count of frozen funds. We did not trace the addresses ourselves.
This Week In The AI Supercycle
Anthropic’s Reality Check, The Capital Squeeze, & The New World Order
This week’s issue: for two years the AI build-out was priced as a growthstory. This week it started being priced as a credit story.
The FBI publicly named North Korea’s TraderTraitor for the Binance theft and asked the industry to block the addresses it listed, 628 by our count. By our arithmetic, the alert came two days after the theft began, against five days for Bybit. TRM had published the same group name a day earlier.
A note on sourcing. Facts come from the FBI’s cyber alert of 31 October 2026, TRM Labs’ blog of 30 October 2026 and NBC News/Reuters on the 2025 Bybit attribution. Day counts, the address count and the frozen share are our arithmetic. We did not trace the addresses or contact the FBI, Binance or TRM.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
