FBI Says North Korea Stole More Than $6 Billion From Binance and Is Converting It to Ethereum

Economic Warfare & Trade Policy

The FBI's J. Edgar Hoover Building in Washington, D.C. (file photo). Photo: ajay_suresh, Wikimedia Commons, CC BY 2.0.

The FBI said Saturday that North Korea was responsible for the theft of more than $6 billion in cryptocurrency from Binance, the world’s largest crypto exchange, on or about Oct. 29, Yonhap reported. “The FBI is releasing information advising the Democratic People’s Republic of Korea was responsible for the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance,” the bureau said in a cyber alert. It named the operation “TraderTraitor,” a name previously tied to North Korean crypto thefts.

Key figures: $6B+ crypto stolen from binance, per the fbi · 3 U.S. agencies urging exchanges to block hacker wallets · 36 flaws cisa added to its exploited list in october through oct. 30

How the stolen funds are moving

The FBI said that, working with the Secret Service and the Internal Revenue Service’s Criminal Investigation division, it had seen the hackers convert stolen assets mainly into Ethereum. It warned that they were expected to launder the funds further through decentralized finance platforms and services that let users quickly swap one digital asset for another.

The three agencies urged crypto exchanges, blockchain operators, analytics firms and other virtual asset service providers to block transactions involving wallet addresses the hackers have used. The alert followed an assessment by the blockchain intelligence firm TRM Labs, which had put the theft at an estimated $6.36 billion and attributed it to TraderTraitor. Our Oct. 30 report on the Binance hack covered the theft when it was first disclosed.

Asked about the hack at Mar-a-Lago on Saturday, President Donald Trump said: “I’m not concerned. We’re learning about it. We don’t know if it’s North Korea, but if it is, we’ll talk to North Korea about it,” Yonhap reported. North Korea had not commented in the sources checked.

Patch deadlines for federal agencies

The Cybersecurity and Infrastructure Security Agency added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog on Oct. 30, according to the catalog. One, CVE-2026-111357, is a missing-authentication flaw that federal civilian agencies must fix by Nov. 2. The other, CVE-2026-118527, involves predictable identifiers and has a Nov. 13 deadline. CISA also listed flaws in GitLab and Cisco firewall software on Oct. 29, both due Nov. 1, and in VMware ESX and the Linux kernel on Oct. 28. The catalog marks ransomware use as unknown for all six. CISA’s catalog showed no additions on Oct. 31 or Nov. 1.

By the numbers

CISA added 36 vulnerabilities to the catalog in October through Oct. 30, a TBR count from the catalog’s dates. The busiest week was Oct. 8-14, with 11 additions. The catalog lists 1,766 entries in total.

Claims and counterclaims

Iran’s state-affiliated Mehr News Agency ran the headline “US fighter jets carry out airstrikes on Syria’s Homs,” but the report it cited, from Lebanon’s Al-Mayadeen network, described “unidentified warplanes” striking south of Al-Sukhnah in the eastern Homs countryside, according to Mehr’s own text !Unverified claim, Mehr News Agency (Iranian state-affiliated media). No government had claimed the strikes in the sources checked. A Mehr report of a fire in Saudi Arabia is covered in today’s Middle East report.

Ukrainian officials told The Kyiv Independent that Kyiv never agreed to pause strikes on Russian oil refineries, disputing an Oct. 29 Wall Street Journal report that it had, the outlet reported. A senior Ukrainian official said U.S. envoy Jared Kushner had suggested a 30-day pause, but “nobody had given such an order.” Less than 24 hours after the Journal’s report, Ukrainian drones struck the Novokuibyshevsk refinery in Russia’s Samara region, the Kyiv Independent reported.

Kremlin aide Yury Ushakov told a reporter for the Russian TV program Vesti that “Putin has never refused to talk” with Ukrainian President Volodymyr Zelensky and that if Zelensky “really wants to negotiate, he is free to come” to Moscow, TASS reported !Unverified claim, TASS (Russian state media). Russia and Ukraine’s competing casualty claims are covered in today’s Russia-Ukraine report, and Taiwan’s dispute with China’s coast guard over an east coast patrol is in our Indo-Pacific report.

Watch for wallet-blocking actions by exchanges, any North Korean response, and federal agencies’ Nov. 2 deadline for the Ivanti flaw.

Sources

• Yonhap News Agency: FBI says N. Korea responsible for over US$6 bln crypto theft from Binance
• Yonhap News Agency: (LEAD) Trump says U.S. will talk to N. Korea if it is behind Binance hack
• Cybersecurity and Infrastructure Security Agency: Known Exploited Vulnerabilities Catalog (JSON feed)
• Mehr News Agency: US fighter jets carry out airstrikes on Syria's Homs
• The Kyiv Independent: Ukraine never agreed to pause strikes on Russian refineries, sources confirm
• TASS: Putin never refused to talk with Zelensky, who is free to come to Moscow — Kremlin aide

Additional sources

• South China Morning Post: Beijing ramps up maritime patrols around Taiwan
• U.S. Department of War news releases