The $6.3 billion Binance theft: the FBI's conclusion, Pyongyang's denial, and the one link anyone can check

The theft itself is the one part of this story nobody disputes. On October 29, 2026, an attacker drained the hot wallets of Binance — the world's largest cryptocurrency exchange — in what every estimator calls the largest crypto theft on record. The estimators do not agree on the number, so SmokeScreen prints each figure with its owner. Binance puts the estimated total impact at approximately $6.3 billion. TRM Labs counts $6.36 billion moved out of Binance wallets across ten blockchains, “most of it in about 20 minutes starting at 20:05 UTC.” Chainalysis puts the transfers at about $6.4 billion — and, in its own theft tally, at about $5.912 billion “at the time it happened”; it also dates the start of the drain to about 4:20 p.m. Eastern, a quarter-hour after TRM's start time. Elliptic counts $6.43 billion across eleven blockchains. The previous record, the $1.5 billion Bybit theft of February 2025, is roughly a quarter of this.

Two days later, on October 31, the FBI published its conclusion. The alert's central sentence — the one on this story's receipt card — reads: “The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.” The bureau calls the activity “TraderTraitor.” It says it has observed the actors, together with the U.S. Secret Service and IRS Criminal Investigation, “converting stolen assets primarily into Ether (ETH),” and it urges exchanges, DeFi services, node operators and analytics firms to block transactions touching the addresses it lists: 628 in all — 608 on Ethereum, 19 on Bitcoin and one on Solana, as counted from the alert by SecurityWeek. That is what the alert contains: a conclusion, a name, two partner agencies, an observation about Ether, and a blocklist.

What the alert does not contain is any evidence. There is no transaction analysis, no methodology, no explanation of how the bureau connected these flows to the North Korean state — and no confidence qualifier: the bureau does not say “high confidence,” it says responsible. The addresses show where money went. They do not, by themselves, show who holds the keys, or what state that person serves. Briefing24, analyzing the same alert on November 2, put it plainly: “The official attribution is clear, but the FBI alert does not publish a detailed evidentiary case.” The attribution may be right. On the published record, it is an assertion with a blocklist attached.

The private analytics firms said it first — and used the confidence language the FBI omitted. Chainalysis, on October 30: “We have a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance.” Its chief executive, Jonathan Levin, said the firm assessed the hack “was likely done by DPRK group TraderTraitor,” citing links to a previous hack. TRM Labs, the same day: “TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence.” TRM published the attack's mechanics in checkable detail — preparation beginning at least 36 hours before the theft, small Tornado Cash withdrawals funding an operator wallet, and 50 pre-signed authorizations, executed in one burst, using an Ethereum feature called EIP-7702. But the “off-chain intelligence” half of its basis is, by definition, not shown — and TRM itself placed a disconfirming detail on the record: the laundering that followed this theft differed from the pattern that followed Bybit.

A third firm declined to fully join them. Elliptic — whose own total, $6.43 billion across eleven blockchains, is the highest of the three — urged caution on the attribution, citing differences in laundering speed and method from earlier North Korea-linked cases and the lack of an established root cause, as reported by SecurityWeek and The Hacker News. Which leaves the one piece of attribution evidence in the entire public record that an outsider can independently check.

On October 30, the independent on-chain investigator ZachXBT published a finding at address level. Funds stolen in the Binance exploit and funds stolen in September's Bitget exploit — about $388 million, itself attributed to TraderTraitor — had been transferred through THORChain and commingled at the same Ethereum address: 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7. The commingling had occurred roughly 45 minutes before he posted. His conclusion: “This indicates the same actor is likely behind both incidents.” Anyone with a public blockchain explorer can look at that address — which is what makes it a receipt rather than an assertion. Two honest limits ride with it: the Bitget attribution the link builds on is itself an earlier attribution, not a judicial finding; and SmokeScreen records the address exactly as published, without independently re-tracing the flows.

The name TraderTraitor carries a documented history, and it cuts both ways. On February 26, 2025, the FBI attributed the $1.5 billion Bybit theft to North Korea under the same name; in December 2024, a joint statement by the FBI, the Defense Department's Cyber Crime Center and Japan's National Police Agency had linked the same activity to the $308 million DMM Bitcoin theft. The UN Panel of Experts, in its final report in the spring of 2024, told the Security Council it was investigating 58 suspected North Korean cyberattacks on cryptocurrency companies between 2017 and 2023, worth about $3 billion — proceeds it estimated generate about half of North Korea's foreign-currency income. The panel no longer exists: it was terminated in April 2024 by a Russian veto, so no UN body can update the figure. The track record is real, and it is why the firms' pattern-matching carries weight. It is also, formally, a stack of earlier attributions being used to support a new one.

The President declined to sign his own bureau's conclusion. At Mar-a-Lago on October 31, after the alert was out, Donald Trump told reporters: “Well, we're learning about it. I'm not concerned. We're learning about it. We don't know if it's North Korea, but if it is we'll talk to North Korea about it.” A day earlier, asked whether North Korean hackers were responsible, he had said — per Hypefresh's account — “We don't know. We're looking at that.” Both statements sit on the record, a day apart: the bureau's flat attribution, and the President's public agnosticism.

On November 2, Pyongyang answered — its first public response to the attribution. Kim Yo Jong, a department director of the Workers' Party Central Committee and the leader's sister, said through the state news agency KCNA: “The FBI is trying to brand the DPRK as a ‘cyber criminal state,’ claiming that it obtained information that a hacking organization ‘supported’ by the DPRK was involved in the incident.” Then the dismissal: “But the US assertion is an absurd rhetoric and nothing new.” And: “It is a grave political provocation against the DPRK that the US misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds.” KCNA carried the word “fabrication” for the claims; Kim rejected the FBI's Bybit attribution too, said Pyongyang opposes all malicious cyber activity, and warned that her country had “issues to reconsider” over the “very unpleasant US hostile attitude.” What the statement did not do was address the commingling evidence. What it offered instead was a hint: “If it carefully examines who will get the large amount of the so-called stolen cryptocurrency when the latter is retrieved, it may get a clue about who is behind the hacking incident.” No evidence accompanied the hint. It is an assertion of the same weight class as the alert it answers.

The victim's own account of how the attackers got in is unsettled — by the victim. Binance's October 30 update said its “initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” and added: “We have found no evidence of any wallet private key leak.” Co-CEO Richard Teng later clarified that the attackers had not simply relied on a single engineer's permissions, and that the investigation had not attributed individual responsibility; the company had found other breach points, and declined to pin the attack on one device. Binance has named no culprit in its own statements, and the detailed technical post-mortem it promised had not been published as of November 2. Binance said approximately $3 billion was frozen on-chain. TRM's itemization of the first night — Tether freezing 971.1 million USDT in the main receiving wallet, Circle about $823 million USDC — builds to about $2.7 billion frozen by 00:30 UTC; Reuters, meanwhile, reported Circle's freeze at “more than $1.1 billion in USDC.” Those two Circle figures cannot both be right, and SmokeScreen prints them together rather than choosing. By TRM's count, the attacker still controls more than 420,000 ETH and 18,270 BTC — about $2.4 billion in assets beyond any issuer's reach. Withdrawals began reopening in phases on November 1. Binance's coverage of the loss ran about 90% on October 31, then about 95% in its November 1 update — a figure restated on November 2 alongside a new Proof of Reserves. And covered is not recovered: the 95% is Binance buying replacement assets with company money, not getting the stolen funds back.

Then the internet added a story of its own. On November 1, a post from the verified X account @doomerfied claimed the way in was a romance: a Binance DevOps engineer romantically involved with a North Korean spy, who left his laptop unattended on the day of the attack — presented as a revelation from ZachXBT. A version posted by the account AlphaWire drew more than 220,000 views, per PANews. The attribution to ZachXBT does not survive contact with his actual findings: they contain no allegation about any employee, any romance, or any unattended laptop — as The Crypto Times' review of his published work and Binance's official disclosures confirms. Binance co-CEO Yi He, answering on X, called the claim “more dramatic, but not true,” and emphasized that ZachXBT never said such a thing. Binance's own words to The Crypto Times: “This claim is completely false. It should be removed and reported as false information.” The romance is a graft: two genuine developments — a laptop Binance says may have been involved, and an attribution investigators did make — fused into a spy story neither one supports.

So the record, sorted. Documented: a theft of roughly $6.3 billion on October 29, the largest on record, most of it moved in about twenty minutes by TRM's clock; an FBI alert dated October 31 that names North Korea and lists 628 addresses; freezes totalling somewhere between TRM's itemized $2.7 billion and Binance's $3 billion; one public address where Binance money and Bitget money met; a President publicly unsure; a North Korean denial; and a recovery Binance is funding itself, at about 95% as of its November 1 update. Asserted, without published evidence: the FBI's attribution itself; the firms' high confidence, resting partly on intelligence no reader can see; the laptop as the way in; and Pyongyang's hint that the trail of retrieved money points back at Washington. Invented: the romance. Neither capital has published its case. The only exhibits a reader can inspect today are the alert, the statements, and one address on a public ledger. The receipts are below. Read the receipts. Decide for yourself.