The FBI announced on Saturday, Oct. 31, 2026, that North Korean hackers were responsible for a cryptocurrency heist from Binance. The bureau identified the attackers as a group known as TraderTraitor, which was also linked to a $1.5 billion hack of the Bybit exchange last year. The theft, which occurred on Thursday, Oct. 29, 2026, is being characterized by investigators and industry experts as the largest cryptocurrency heist in history.
The incident targeted Binance, the world's largest cryptocurrency exchange. Early reports cited by ABC News (Australia) suggest the hackers gained access through phishing, specifically targeting a member of the company's development or engineering team. During the heist, which lasted approximately 20 minutes, the attackers moved assets across 180 different tokens, including bitcoin, ether, and various stable coins pegged to traditional assets like gold or the U.S. dollar.
In response to the announcement, President Donald Trump, speaking from his Mar-a-Lago estate on Saturday night, expressed uncertainty regarding the perpetrator. While the FBI issued a formal statement naming North Korea, the president told reporters, "We don't know if it's North Korea," though he noted that such a determination could eventually be made. The FBI has requested that blockchain analytics firms and other exchanges block transactions associated with specific digital addresses to prevent the laundering of the stolen funds.
The FBI's investigation found that the hackers have primarily been converting the stolen assets into ethereum and are expected to use decentralized finance (DeFi) and "instant swap services" to further obscure the money's origins. Ari Redbord, chief policy officer at TRM Labs, described the event as "bank robbery at the speed of the Internet," noting that hackers often break stolen assets into smaller pieces to evade detection across various exchanges.
For individual investors and account holders, the concrete day-to-day impact is currently managed by Binance’s freeze on $4.2 billion in assets to stem the flow of stolen funds. Users may experience temporary restrictions on withdrawals or trading for certain tokens as the exchange works to recover the remaining missing capital. Experts cited by ABC News warn that the use of AI has accelerated the ability of small groups of hackers to conduct heists that previously required 20 or 30 people.
What happens next depends on the success of global "track and trace" efforts conducted by the FBI and blockchain intelligence firms. There is currently no set date for when the frozen $4.2 billion will be fully accessible or when the remaining 10% of reimbursement funds will be distributed to affected users. The FBI continues to monitor TraderTraitor’s attempts to swap assets, while Binance remains in "damage control" to stabilize its internal reserves and maintain customer asset safety.