FBI Attributes $6 Billion Binance Theft to North Korea-Linked Group; Elliptic Estimates $6.43 Billion
The FBI says North Korea-linked hacking operation TraderTraitor stole more than $6 billion from Binance on October 29, 2026. Blockchain analytics firm Elliptic estimates the stolen assets were worth $6.43 billion. It has tracked extensive movement across crypto networks, but those figures are a snapshot, not a final recovery tally.
- The FBI named TraderTraitor; public blockchain records show fund movements, not who controlled every wallet.
- Elliptic reported $2.85 billion frozen or seized and about $3.24 billion still in linked addresses.
- Cross-chain transfers complicated tracing but did not make the funds invisible.
- The available FBI and Elliptic accounts do not establish how Binance customers were affected.
What investigators say happened
The FBI said the theft occurred “on or about October 29” and attributed it to TraderTraitor, a group it associates with North Korean cyber activity. The bureau published wallet addresses it said were operated by or closely connected to the group. It asked digital-asset businesses to block transactions linked to those addresses.
The FBI said it worked with the U.S. Secret Service and IRS Criminal Investigation. Its alert said the attackers converted the stolen assets primarily into Ether and warned that the funds could move through decentralized finance platforms and instant-swap services.
The attribution is the FBI’s official assessment. Elliptic’s November 2 analysis traces transactions associated with the theft and identifies it as a TraderTraitor operation. But blockchain records alone do not identify the person behind every wallet or independently prove who directed the attack.
The available FBI and Elliptic accounts do not say whether the stolen assets came from customer balances, Binance-controlled wallets or another type of wallet associated with the exchange. They also offer no final accounting of customer losses.
Following the funds across networks
Elliptic estimates the stolen assets were worth $6.43 billion. Its analysis describes a rapid series of swaps, transfers between blockchains and movements across thousands of addresses. That activity made the trail more complex, but did not erase the public transaction history.
Much of the initial activity took place on Tron. Elliptic traced funds across about 7, 700 Tron addresses and roughly 32, 000 transactions. The assets then moved through at least seven cross-chain bridges, services that transfer assets between different blockchain networks. Elliptic said almost all of the bridged TRX was paid out as ETH on Ethereum. At the time of its report, at least $147 million had been bridged out of Tron.
The FBI warned that the attackers could use DeFi platforms and instant-swap services. DeFi refers to financial services built on blockchain systems rather than run solely by conventional intermediaries. Swapping one cryptocurrency for another can complicate tracking, but it is not the same as cashing out. The funds can remain visible on-chain and linked to the theft.
Elliptic reported that the stolen assets included $3.46 billion in stablecoins, or 54% of its estimated total. Stablecoins are cryptocurrencies designed to track the value of assets such as the U.S. dollar. Some issuers can freeze tokens they control, giving investigators a potential point of intervention.
Elliptic estimated that $786 million in stolen stablecoins was converted into other cryptoassets before freezes took effect. It reported that Tether froze stolen USDT on Ethereum 37 minutes after the tokens arrived. Before the freeze, the attacker had swapped 434 million USDT for ETH and used another 59.9 million USDT as collateral to borrow 19, 762 ETH on Aave. Borrowing against collateral is a loan, not a sale of the collateral.
On Tron, Elliptic said the attacker swapped 234 million USDT for TRX before Tether froze the remaining amount. According to Elliptic, Circle, the issuer of USDC, froze all 823 million stolen USDC before any of it was swapped.
Elliptic also tracked about 28 BTC, worth $2.2 million at the time, entering 18 CoinJoin transactions by 06:02 UTC on November 2. CoinJoin is a collaborative Bitcoin transaction technique that can make it harder to link specific inputs to outputs. It can obscure parts of a trail, but it does not automatically remove transactions from the public ledger.
Frozen funds are not necessarily recovered funds
Elliptic reported that $2.85 billion had been “frozen or seized, ” about 44% of its $6.43 billion estimate. The firm’s report does not identify who was responsible for every amount in that combined figure or how each amount was frozen or seized. And a freeze or seizure does not, by itself, mean the assets have been returned to Binance or its customers.
Elliptic estimated that about $3.24 billion remained in addresses linked to the incident, primarily in Bitcoin and Ethereum. It reported that 18, 270 stolen BTC were split across 19 addresses and had not moved as of its analysis. On Ethereum, about 68, 700 ETH was spread across roughly 850 addresses. Elliptic said the nine largest addresses held 89% of the attacker’s ETH and had not moved since October 30.
These figures are not a complete balance sheet. The $2.85 billion reported frozen or seized and the $3.24 billion still in linked addresses add up to $6.09 billion, about $340 million less than Elliptic’s estimated theft value. The report does not explain the gap or establish whether the categories overlap. Treat the figures as time-bound estimates, not a fully reconciled account.
Elliptic assessed that only a negligible amount had likely been cashed out by the time of its report. That is the firm’s estimate, not a final determination. Converting stolen tokens into other cryptocurrencies can make tracking harder, but turning crypto into conventional money generally requires an off-chain buyer or service. That creates another point where funds may be identified or stopped.
What remains uncertain
The FBI’s alert names TraderTraitor, but the public account does not lay out the full intelligence or attribution method behind its conclusion. Elliptic provides detailed transaction analysis and assesses that much of the remaining Bitcoin and ETH is likely still held by North Korea. That assessment is not direct proof of who controls each address.
The public accounts also leave important questions about the breach and its consequences unanswered: how the attackers gained access, which wallets were affected, and how much of the stolen value will ultimately be recovered. They do not verify claims that Binance replenished 95% of affected assets, restored withdrawals on a particular schedule or completed a reserve verification. Those claims need a substantiated Binance statement or independent confirmation.
The FBI’s request to block transactions tied to listed addresses gives exchanges, token issuers and other service providers a practical way to intervene. Their ability to act depends on the assets and services involved. A centralized stablecoin issuer may be able to freeze its tokens, but that does not mean every decentralized protocol or blockchain transfer can be stopped. Even when assets are immobilized, returning them to the rightful recipient is a separate step.
Key questions and answers
-
Who does the FBI blame for the Binance theft?
The FBI attributes it to TraderTraitor, a hacking operation it associates with North Korea. Elliptic traced related transactions, but public blockchain records do not establish who controlled every wallet.
-
How much was stolen?
The FBI said more than $6 billion. Elliptic estimated $6.43 billion. The figures come from different sources and are not a single audited total.
-
Were $2.85 billion in assets recovered?
Elliptic reported that this amount had been frozen or seized. Its report does not establish that all of it was returned to Binance or its customers.
-
Did moving funds across blockchains hide them?
Bridges and swaps made the trail more complicated, but did not necessarily make the funds untraceable. Elliptic followed transfers from Tron to Ethereum and tracked other activity across crypto services.
-
Has Binance confirmed customers were made whole?
The FBI and Elliptic accounts do not confirm customer reimbursement or a final accounting of losses. Claims that Binance replaced funds or restored withdrawals need separate, reliable confirmation.
