On 31 October the Federal Bureau of Investigation (FBI) officially linked the attack on Binance to the Democratic People’s Republic of Korea (DPRK) and named the TraderTraitor group as the likely perpetrators.
Description of fund movements and laundering methods
After the theft, the perpetrators actively moved assets across blockchain networks, converting a significant portion into Ethereum (ETH). The FBI noted possible use of decentralised finance (DeFi) services and instant swap platforms to obscure the funds’ origin.
The bureau also released a list of crypto addresses linked to members of TraderTraitor; the list includes addresses on the Ethereum, Bitcoin and Solana networks. Authorities have asked network operators and services to monitor transactions and block operations associated with the suspicious wallets.
Who was urged to stop the movement of the stolen funds
The appeal targeted not only major exchanges but also operators of THORNode and remote procedure call (RPC) nodes, DeFi platforms, crypto exchange services and blockchain analytics firms. These market participants are expected to review transactions and block operations related to the suspects’ wallets.
Participants were also urged to report any information about the group or related transactions through the bureau’s local field offices or via the Internet Crime Complaint Center (IC3) at ic3.gov.
Progress of the Binance attack investigation and the exchange’s actions
The large-scale attack on Binance occurred on the evening of 29 October 2026. According to estimates from TRM Labs, about $6.36 billion was withdrawn from the exchange’s wallets, and most of the funds were moved across ten blockchain networks in roughly 20 minutes.
Binance’s preliminary investigation points to a possible compromise of a laptop belonging to one of its DevOps engineers, which may have allowed the attacker to access a service container and initiate unauthorised transactions. The exchange has not found evidence of private wallet keys being leaked.
Asset freezes and compensation for users
Following the attack, the exchange engaged law enforcement and blockchain analytics companies to trace the asset flows. Binance said that, together with partners, it managed to freeze about $3 billion.
Binance also pledged to fully reimburse users’ losses using the Secure Asset Fund for Users (SAFU) and its own funds, while work continues to recover assets and identify specific perpetrators.
Estimates of the impact on Ukrainian cryptocurrency holders
It is estimated that between 6.5 and 7 million Ukrainians own cryptocurrency, but it is unknown what share of those assets is held on Binance. Determining the number of potentially affected users is currently difficult.
Vadym Denysenko, head of the analytical centre «Dilova Stolytsia», believes Binance’s problems could affect not only private investors but also shadow financial flows linked to corruption, money laundering and capital flight.
