📅 31 October 2026 • FBI
The FBI has issued the first official law-enforcement attribution of the record theft from Binance, naming TraderTraitor, tracked alongside Lazarus Group and APT38, and publishing a list of wallet addresses for the industry to screen and block.
First official attribution
Per the FBI cyber alert published October 31, 2026, North Korea was responsible for the theft of more than 6 billion dollars in virtual assets from cryptocurrency exchange Binance on or about October 29, 2026. According to the alert, attribution points to TraderTraitor. The link to Lazarus Group and APT38 comes from US Treasury and industry tracking, not from this alert. Widely reported scale is 6.36 billion dollars across 10 blockchains, the largest crypto theft in history. The previous record was Bybit at about 1.5 billion dollars in February 2025, attributed by the FBI to the same group in its 2025 alert, not in this one.
From analytics reports to an action list
Earlier attributions of this theft came from private blockchain-analytics firms, TRM Labs and Chainalysis. This alert is the first official law-enforcement attribution by US authorities, and it adds an actionable instrument, a public list of flagged wallet addresses. FBI asks cryptocurrency exchanges, blockchain node operators including THORNode operators and RPC nodes, DeFi platforms and blockchain analytics providers to block transactions from these addresses and assist the investigation.
FBI, USSS and IRS-CI jointly observe conversion of the stolen assets primarily into Ethereum, with further laundering expected through DeFi services and instant swaps. Compliance teams should also update filters for ETH conversion and DeFi laundering flows.
Binance response and compliance baseline
Binance stated that about 90 percent of the stolen funds were replenished, per the company statement reported by media on November 1, 2026. Lazarus Group-linked activity has been under OFAC sanctions designation since 2019. Obligations for VASPs are sanctions and transaction screening against the published address list, blocking of flagged transactions, and suspicious activity reporting via SAR filing.
IMPACT
Who is affected — exchanges and VASPs, node operators (THORNode and RPC nodes), DeFi platforms and instant swaps. What changes — screen against the FBI address list, block flagged transactions, file SARs, update filters for ETH conversion and DeFi laundering flows. Timelines — act on the alert as published, since exposure grows while funds keep moving. Risks of non-compliance — processing designated funds creates sanctions exposure, enforcement action and loss of banking partners.
Sources: fbi.gov — bloomberg.com — cbsnews.com — news.bitcoin.com
Continue the conversation: https://t.me/ComplianceExplained · Bluesky
Top comments (0)