Lessons · Investigative evidence
Who Was Behind the Binance Hack? From On-Chain Traces to the FBI Statement
Dozens of explanations emerge in the first hours after a major theft. But a resemblance to an earlier attack, an analyst’s assessment and an official law-enforcement statement are different things.
EDITORIAL OVERVIEW · Prepared by the project editors from the sources listed below.
The investigators’ assessments
The Binance investigation has already moved through several of these stages.
TRM Labs linked the attack to the North Korean group TraderTraitor, expressing high confidence in its assessment. The company cited a combination of blockchain data and information from outside the blockchain. The full body of that evidence has not been publicly disclosed.
Chainalysis published a more specific argument: funds stolen from Binance commingled on-chain with proceeds from September’s Bitget theft, which had previously been linked to North Korean actors. The company described this connection as an important basis for its attribution to TraderTraitor. This was not simply similar behaviour, but an intersection of observable flows of funds.
The FBI’s public statement
An official FBI statement followed on October 31. The bureau attributed the theft of more than $6 billion from Binance to North Korea and referred to the associated cyber activity as TraderTraitor. Saying that analysts merely suspect North Korea therefore no longer reflects the latest public status of the case.
The FBI statement does not, however, name the individuals who carried out the attack or announce their arrests. Attributing an attack to a group is not a published court judgment against a particular person.
The mention of a Binance employee’s laptop also requires care. A compromised device does not imply that its owner was an accomplice. A preliminary technical explanation must not become a personal accusation.
Following the funds
An investigation continues even after an assessment of who organised the attack. Together with the US Secret Service and IRS Criminal Investigation, the FBI reported observing the conversion of stolen assets primarily into ETH. The bureau published associated addresses and urged crypto services to restrict transactions linked to those flows. The public investigation now concerns not only who was responsible, but also where the money goes next.
Sources and verification
Information checked November 2, 2026. The FBI’s official attribution is distinguished from researchers’ assessments and from a court judgment against an individual. A compromised employee device does not establish complicity.
Unless stated otherwise, the text, conclusions, structure and editorial arrangement were created by the project editors. Facts, quotations and source materials remain attributable to their authors and rights holders.
← Back to the rubric