CZ Thanks Secret Service After $6B Binance Theft
After a major cryptocurrency theft from Binance on October 29, 2026, investigators and industry partners froze a significant portion of the assets. The Secret Service has not said how much was frozen, and no final recovery total has been reported.
- The FBI attributed the theft to North Korean actors it calls TraderTraitor.
- Binance pledged to cover affected users’ losses.
- Estimates of the funds involved range from more than $6 billion to $6.36 billion, but the figures measure different things.
- Binance’s theory about how the attackers gained access is still preliminary.
Binance founder Changpeng Zhao thanked the U.S. Secret Service and other investigators in a November 2, 2026, post on X. He said agencies and industry partners responded “within minutes.”
“Your speed, expertise, and dedication helped contain the damage and reduce the risk of potential ripple effects across crypto and, may I say, even the broader financial markets, ” Zhao wrote.
On November 1, the Secret Service said investigators and cryptocurrency-industry partners had identified and frozen a significant portion of the stolen assets. The agency did not say how much. Crypto.news previously reported an estimate of roughly $3 billion frozen, citing industry partners, not the Secret Service.
What do the $6 billion estimates measure?
The FBI said the theft involved more than $6 billion in virtual assets. Binance estimated that about $6.3 billion in cryptocurrency was affected. Blockchain intelligence firm TRM Labs estimated that attackers transferred approximately $6.36 billion across 10 blockchain networks, with most of the movement taking place within roughly 20 minutes.
These figures do not necessarily refer to the same thing. “Affected, ” “stolen” and “transferred” can describe different measures, and the available estimates do not say whether funds moving between networks were counted more than once. The figures show the scale of the incident, but they do not establish a reconciled total of unique assets stolen.
A freeze is also different from a recovery. A freeze can stop identified assets from moving, often with help from platforms or service providers. It does not mean the cryptocurrency has been returned or that investigators have identified the people behind every wallet.
FBI attributes the theft to TraderTraitor
On October 31, 2026, the FBI attributed the theft to North Korean actors it identifies as TraderTraitor. That is the bureau’s assessment of responsibility. It does not amount to publicly identifying the people who carried out the attack.
Investigators saw the attackers convert assets primarily into Ethereum. The FBI said it expected further laundering through decentralized finance (DeFi) protocols and instant-swap services, which exchange one cryptocurrency for another. Available information does not show how extensively the attackers ultimately used those methods.
The FBI published Ethereum addresses that it said currently held, or had previously held, stolen cryptocurrency and were operated by or closely connected to TraderTraitor. It asked operators of THORChain nodes, blockchain-connection infrastructure, instant exchanges, DeFi services and blockchain analytics firms to block transactions involving wallets linked to the theft.
Public blockchains make transactions traceable, but tracing funds does not automatically stop them from moving or force anyone to return them. Investigators may need help from services that can restrict transactions at specific points.
Binance’s access theory is not confirmed
Binance’s preliminary investigation suggested that an attacker may have compromised a DevOps engineer’s laptop. DevOps engineers work on software deployment and infrastructure. Binance’s theory is that access to the laptop may have enabled unauthorized entry to an internal service container used to submit withdrawal transactions. The exchange has not confirmed this as the cause of the breach.
Binance said it found no evidence that wallet private keys had been leaked and revoked the affected authorization. It temporarily restricted withdrawals while it carried out security checks and prepared to restore services across affected networks.
The exchange pledged to cover affected users’ losses with company resources and its Secure Asset Fund for Users. Binance said the amount it ultimately has to absorb will depend partly on how much cryptocurrency is recovered. That affects the exchange’s net cost, not its stated commitment to cover users’ losses.
Market stress, but no proven cause
Crypto.news reported that Bitcoin and major altcoins fell as liquidations exceeded $1.5 billion on October 30, 2026. Liquidations are forced closures of leveraged positions when prices move against traders. The figures show market stress, but they do not establish that the Binance theft caused the price declines or how much it contributed.
The reported theft exceeded the roughly $1.5 billion stolen from Bybit in February 2025, making it one of the largest cryptocurrency security incidents on record. If Binance’s preliminary access theory is confirmed, the incident would highlight a less glamorous but serious security risk: a compromised employee device can provide a path into systems that handle withdrawals. For now, investigators have not confirmed that this is what happened.
Key questions and answers
-
Who did the FBI blame for the Binance theft?
The FBI attributed it to North Korean actors it calls TraderTraitor. The bureau has not publicly identified the individuals involved.
-
How much cryptocurrency was frozen?
The Secret Service confirmed a significant freeze but disclosed no amount. Crypto.news reported an industry-partner estimate of roughly $3 billion.
-
Have the stolen funds been recovered?
No final recovery total has been reported. A freeze can restrict funds without returning them.
-
How did the attackers gain access?
Binance’s preliminary theory involves a potentially compromised DevOps engineer’s laptop and an internal service container. The cause has not been confirmed.
-
Will Binance cover affected users’ losses?
Binance said it would use company resources and its Secure Asset Fund for Users to cover them. How much the exchange ultimately absorbs depends partly on asset recovery.
The FBI asked anyone with relevant information to contact a local field office or submit it through the Internet Crime Complaint Center. The final recovery figure and the precise route into Binance’s withdrawal systems remain unresolved.
