# FBI Says North Korea Stole $6.3 Billion From Binance, and About Half Is Frozen

Stablecoin issuers froze roughly $3 billion within days, but 18,270 bitcoin worth about $1.4 billion sit untouched in 19 wallets, out of reach of any issuer.

- Published: 2026-11-02T05:45:39.855Z
- Canonical: https://polylog.news/crypto/2026-11-02/fbi-says-north-korea-stole-6-3-billion-from-binance-and-abou
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Polylog editors](https://polylog.news), [crypto.news](https://crypto.news/cz-thanks-secret-service-for-freezing-funds-after-6b-binance-hack/), [CoinDesk](https://www.coindesk.com/tech/2026/11/02/strangers-are-begging-the-binance-hacker-for-bitcoin-one-help-me-bro-at-a-time), [BleepingComputer](https://www.bleepingcomputer.com/news/security/fbi-links-63-billion-binance-crypto-heist-to-north-korean-hackers/), [The Hacker News](https://thehackernews.com/2026/10/binance-suffers-security-breach.html), [Forbes](https://www.forbes.com/sites/digital-assets/2026/10/30/binances-63-billion-hack-started-with-one-engineers-laptop/)

The Federal Bureau of Investigation (FBI) has said North Korea was responsible for stealing [more than $6 billion in digital assets from Binance](https://t.me/BWEnews/16594) on or about October 29, according to a Reuters report. [BleepingComputer reports](https://www.bleepingcomputer.com/news/security/fbi-links-63-billion-binance-crypto-heist-to-north-korean-hackers/) that the FBI named TraderTraitor, the North Korean state unit that blockchain analysts link to earlier exchange thefts, and called the theft the largest crypto heist on record. None of the reporting reviewed for this article includes a response from North Korea.

The attack did not use a flaw in any smart contract. According to [Forbes](https://www.forbes.com/sites/digital-assets/2026/10/30/binances-63-billion-hack-started-with-one-engineers-laptop/), Binance traced the breach to a compromised laptop belonging to a DevOps engineer. From that laptop, the attackers reached a service container and submitted withdrawal transactions that Binance's own systems then signed. Security analysts quoted in the coverage say the attackers held a full-access token to a hot wallet (an exchange wallet whose keys sit on internet-connected machines), and that the token never expired. The root cause was compromised credentials combined with excessive privilege granted to a single internal service. Reports put the theft at about $6.3 billion moved across nine or ten blockchains, depending on the tracker, with most of it gone in roughly 20 minutes.

Recovery has split along one line: whether the asset has an issuer that can freeze it. [The Hacker News reports](https://thehackernews.com/2026/10/binance-suffers-security-breach.html) that Tether and Circle froze more than $1.5 billion in USDT and about $800 million in USDC, bringing total frozen funds to roughly $3 billion. The United States Secret Service said it [is continuing to investigate](https://t.me/WatcherGuru/15748) and that [a large portion of the stolen funds is already frozen](https://t.me/cointelegraph/72992). Changpeng Zhao, Binance's founder, [thanked the Secret Service and federal investigators](https://crypto.news/cz-thanks-secret-service-for-freezing-funds-after-6b-binance-hack/) in a November 2 post on X.

The bitcoin is a different matter. [CoinDesk reports](https://www.coindesk.com/tech/2026/11/02/strangers-are-begging-the-binance-hacker-for-bitcoin-one-help-me-bro-at-a-time) that the 19 wallets holding 18,270 stolen BTC have received nothing since Thursday except payments worth less than a dollar each. Each payment carries a message, ranging from pleas for money to offers of laundering services. The coins have not moved. No issuer can freeze them, so the only places to stop them are the exchanges, bridges and swap services they must eventually pass through. The FBI has [urged decentralized finance (DeFi) platforms, including THORSwap (a cross-chain swap exchange), and remote procedure call (RPC) node operators](https://t.me/BWEnews/16595) to block transactions from the attacker addresses.

The political response has been mild. President Donald Trump said, ["We don't know if it's North Korea but if it is we will talk to them"](https://t.me/BWEnews/16596), a remark he made before the FBI attribution became public. The analyst Darkfost estimates that North Korean hackers have now stolen [about $11.87 billion in crypto in total](https://t.me/GokuCryptoNews/21174), an amount he puts at roughly 45 percent of the country's annual gross domestic product. That ratio is one analyst's estimate, and North Korean output figures are themselves uncertain.

## What this means

Two forces are in play. The first is freeze power. Freezes work on stablecoins and on the chains that issuers control, and they do not work on bitcoin. That leaves roughly $1.4 billion in BTC that can only be stopped where it leaves the chain, so the pressure falls on neutral infrastructure such as THORSwap, RPC providers and over-the-counter desks. Those operators now have to decide whether to censor transactions at the FBI's request. The precedent is Bybit's roughly $1.5 billion loss in February 2025. The FBI attributed that theft to North Korea within days, yet the attackers still converted most of the stolen ether over the following weeks through cross-chain swap routes. The common view is that freezing half the stolen funds counts as a success. In fact, the half that was frozen is the half that was always freezable. The desk's assessment is that the likelier outcome is that the bitcoin starts moving within weeks to months, in small amounts through swap services and mixers. US agencies would then move from requests to formal actions against services that keep processing it, which would tighten the line between compliant and non-compliant infrastructure. The read is wrong if a large share of the 18,270 BTC is seized at an exchange or returned. On the market side, Binance says it has covered about 95 percent of the loss from its own reserves. As long as that holds, the event becomes a test of stablecoin issuers' power as enforcement agents rather than a solvency shock.

## What to watch

- Whether any of the 19 bitcoin wallets moves funds, and where the coins go first. A swap service or mixer would mean the laundering pattern seen after Bybit is repeating, while a regulated exchange would give investigators a chance to seize the funds.
- Whether THORSwap, THORChain node operators or large RPC providers publicly agree to block attacker addresses. Agreement would extend enforcement into infrastructure that markets itself as neutral.
- Any update from Tether, Circle or the Secret Service that raises or lowers the frozen total. The ratio of frozen to unrecovered funds shapes how future attackers pick which assets to steal.