Three days after the Binance hack, the US government put its name to the attribution. On Saturday, October 31, 2026, the FBI — together with the Secret Service and IRS Criminal Investigation — said North Korea’s TraderTraitor group stole more than $6 billion in virtual assets from Binance on or around October 29, and published a list of attacker addresses for the industry to block.
The same weekend, THORChain — one of the routes analysts had flagged for laundering — paused trading on ten of its thirteen connected chains. The trigger, according to reports, was a technical fault rather than the hack. The effect was the same: one exit closed.
Key facts
- On October 31, 2026, the FBI, Secret Service and IRS-CI attributed the theft of more than $6 billion from Binance to North Korea’s TraderTraitor.
- The notice lists more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address, and asks companies to block transactions with them.
- Elliptic counts $6.43 billion stolen and $2.85 billion (44%) frozen or secured; stablecoins make up 94% of the frozen amount.
- Elliptic says the attacker still holds about $3.21 billion in native coins, including 519,104 ETH and 18,270 BTC.
- THORChain halted trading on 10 of 13 chains, including Bitcoin, Ethereum, Solana and Tron, after an Ethereum reorg made a confirmed 10 ETH deposit disappear.
- Before the pause, THORChain paid out 17,019 ETH to 170 addresses and 53.25 BTC to 20 addresses; about $44 million of Tron-side loot used it as a route, per SomaXBT.
What did the FBI say about the Binance hack?
The FBI attributes the theft of more than $6 billion from Binance, committed on or around October 29, 2026, to TraderTraitor — the name US authorities have used since 2022 for a North Korean state-backed campaign against crypto companies. The notice lists attacker addresses on three chains and asks node operators, swap services, DeFi protocols and other service providers to block transactions with them.
According to ABC News, the FBI expects the attackers to keep moving funds through DeFi services and instant swap services. The notice is a request to industry, not a sanctions order: no addresses had been added to the SDN list as of November 1.
What TraderTraitor does
US authorities link TraderTraitor to fake job offers, doctored application documents, trojanised trading software and months-long contact with employees of target companies. They also hold it responsible for the February 2025 Bybit theft of about $1.46 billion.
A blocklist closes doors. The money still looks for the ones left open.
Where is the stolen Binance money now?
Elliptic’s analysis counts $6.43 billion stolen across eleven blockchains in about three hours and $2.85 billion frozen or secured — 44% of proceeds, 94% of it stablecoins. The attacker still holds about $3.21 billion in native coins: around 519,104 ETH and 18,270 BTC. The Bitcoin is being split across 19 addresses in a peel chain and, as of Elliptic’s latest reading, none had reached a service provider.
The laundering is fast and partly automated. Elliptic says 434 million USDT were swapped into 160,451 ETH at a 12–26% discount, and the main Tron laundering wallet sent 546 transfers with a median interval of 96 seconds. Binance says it has replaced 90% of the missing holdings from corporate funds and reopened withdrawals.
Why did THORChain halt trading?
THORChain paused trading on 10 of its 13 connected chains on October 31 after an Ethereum block reorg made a confirmed 10 ETH deposit disappear. The related swap failed and was refunded, leaving the vault 10 ETH short; an automatic solvency check halted Ether trading, and node operators then suspended trading on more chains. Users returned the 10 ETH and the vault is solvent again.
The pause also blocked one of the laundering routes. On-chain analyst SomaXBT, cited by The Block, counts about $242 million laundered from Tron in two days, with Relay ($48 million), THORChain ($44 million), Chainflip ($32.1 million) and Symbiosis ($16 million) as the biggest routes. By Monday, trading had resumed on Avalanche, Base and the XRP Ledger; Bitcoin, Ethereum and Solana remained halted with no date given.
What this means for swap users
When a theft this large is in motion, every swap route is under scrutiny. Providers screen deposits against the FBI’s addresses and analytics firms’ labels, and some routes pause or slow down. For ordinary users that can mean an extra check or a longer wait; for the attacker it means fewer doors. Both are working as intended.
If a swap is held for review, the provider will usually ask for proof of origin; our AML policy explains the process and the refund address guide covers what happens if a deposit is declined. On SwapZilla you can see which provider handles each quote on the providers page. For background on why cross-chain routes are high-risk targets, see our guide to bridge hacks and safe swapping.
Final thoughts
The FBI’s list turns analysts’ attribution into an official request to the whole industry. About 44% of the loot is frozen; the rest is native ETH and BTC that only service providers can refuse. The next months will show how many of them do.