# FBI blames North Korea's TraderTraitor for $6.3 billion Binance theft as Trump says "we don't know"

Binance says it will cover about 90% of the loss. The FBI has asked decentralized finance operators to block hundreds of wallet addresses, and Chainalysis says the attackers have already used thousands.

- Published: 2026-11-01T05:14:26.029Z
- Canonical: https://polylog.news/2026-11-01/fbi-blames-north-korea-s-tradertraitor-for-6-3-billion-binan
- Publisher: Polylog (Global desk)
- Section: crypto
- Sources: [Financial Times Technology](https://www.ft.com/content/c7062e37-86fd-45ef-8f58-573de0fcaaf0?syn-25a6b1a6=1), [CoinDesk](https://www.coindesk.com/policy/2026/10/31/fbi-confirms-north-korea-s-role-in-usd6-billion-binance-hack-asks-defi-community-to-block-btc-eth-sol-addresses), [The Japan Times (Business)](https://www.japantimes.co.jp/business/2026/11/01/tech/binance-hack-fbi-north-korea/), [Kommersant](https://www.kommersant.ru/doc/9078368)

The Federal Bureau of Investigation (FBI) said a North Korea-linked group known as TraderTraitor carried out the theft of more than $6 billion in digital assets from Binance, the largest cryptocurrency exchange. The [Financial Times described the theft as a record](https://www.ft.com/content/c7062e37-86fd-45ef-8f58-573de0fcaaf0?syn-25a6b1a6=1) and reported that other exchanges are tightening security. In an October 30 statement, Binance put the total impact at $6.3 billion and said about [$3 billion had been frozen](https://en.cryptonomist.ch/2026/10/31/bitcoin-price-drop-binance-breach/). The exchange said it will [cover about 90% of the loss](https://www.japantimes.co.jp/business/2026/11/01/tech/binance-hack-fbi-north-korea/) and restore withdrawals.

The FBI is relying on other parties to help stop the funds from moving. Its notice listed hundreds of Bitcoin, Ethereum and Solana addresses and asked operators in decentralized finance (DeFi), the trading and lending services that run without a central intermediary, to block them. Blockchain analytics firm Chainalysis told [CoinDesk](https://www.coindesk.com/policy/2026/10/31/fbi-confirms-north-korea-s-role-in-usd6-billion-binance-hack-asks-defi-community-to-block-btc-eth-sol-addresses) that the attackers have already used "thousands" of addresses and that it expects the number to keep rising. The FBI ties TraderTraitor to the [$1.5 billion theft from Bybit](https://www.dw.com/en/fbi-says-north-korea-behind-6-billion-binance-crypto-theft/a-79819998) last year.

The White House has not adopted the FBI's finding. At a Halloween event at Mar-a-Lago, Trump said investigators were looking into the theft and added, ["We don't know if it's North Korea."](https://thehill.com/policy/technology/6185518-trump-binance-crypto-hack-north-korea/) In its morning digest, the Russian business daily [Kommersant](https://www.kommersant.ru/doc/9078368) reported that the FBI had blamed TraderTraitor and that Trump had disputed the statement. Russian outlets gave the split between the president and his own investigators equal weight with the attribution.

The market damage was limited. Bitcoin traded near [$77,170 early on October 31](https://en.cryptonomist.ch/2026/10/31/bitcoin-price-drop-binance-breach/), about 39% below its record high. US spot bitcoin exchange-traded funds (ETFs) recorded about $643 million of net outflows on October 30. [CNBC noted](https://www.cnbc.com/2026/10/30/binance-hack-bitcoin-price.html) that bitcoin fell less than it had after earlier exchange hacks, because the attack hit a custodian and not the Bitcoin network.

## What this means

The loss falls first on Binance's balance sheet, because the exchange has promised to cover about 90%. The question that matters most for users is whether withdrawals reopen in full and on time. North Korea gains hard currency outside the sanctions system if it can launder the funds, and the FBI's main tool against that is to ask private DeFi operators to screen addresses. That request moves crypto infrastructure toward permissioned, monitored access, which is a step toward the surveillance the desk tracks under its sixth working thesis. Trump's public doubt is new information. It weakens the official US position that would support seizures and sanctions, and it suggests the administration does not want a confrontation over the theft. The likelier outcome within weeks is a fight over control of the roughly $3 billion that has been frozen, and wider adoption of address blacklists by large DeFi front-ends and stablecoin issuers. The read depends on Binance restoring withdrawals as promised. If it delays or limits them, that would point to a funding gap, and the story would become a solvency question for the largest venue in the market.

## What to watch

- The date and scope of Binance's full withdrawal restoration, because delays would show whether the 90% coverage pledge is funded.
- Whether major stablecoin issuers freeze tokens at the addresses the FBI listed, which would show how much of the stolen money can still be stopped.
- Whether the White House or the Treasury formally adopts the FBI attribution, which would open the way to sanctions on laundering services.