North Korea Launders Binance Crypto Theft Across 11 Blockchains

A massive cryptocurrency theft targeting Binance has triggered an extensive international investigation after blockchain analysts traced the movement of stolen assets across 11 networks. The October 29 attack, attributed by the FBI to North Korea, involved approximately $6.43 billion in digital assets and prompted an increasingly complex laundering operation involving thousands of cryptocurrency wallets.

According to blockchain analytics company Elliptic, investigators identified approximately 12,000 wallets and more than 40,000 transactions within less than four days. The operation used automated transfers to distribute assets across multiple networks, making the movement of funds increasingly difficult to track.

Elliptic estimated that approximately $3.24 billion remained in addresses associated with the theft as of November 2. Meanwhile, approximately $2.85 billion in assets had been frozen or seized, while the remaining funds continued moving through different cryptocurrency networks.

The investigation found that Tron became the primary distribution channel during the initial laundering stages. Approximately 684.6 million TRX was distributed across roughly 7,700 addresses before portions were transferred to Ethereum through cross-chain bridges.

Elliptic also identified approximately 68,700 ETH distributed across around 850 smaller addresses. The investigation subsequently detected movements involving NEAR, Solana and XRP, alongside approximately 28 BTC worth $2.2 million processed through coin-mixing transactions.

The FBI identified the North Korean cyber operation as TraderTraitor and said the stolen assets were being converted primarily into Ethereum. Federal investigators urged cryptocurrency exchanges and other digital asset service providers to block transactions involving addresses connected to the incident.

In its public statement, the FBI formally attributed the theft to North Korea.

"The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026," the FBI said.

The investigation also drew attention from US President Donald Trump, who said his administration was still collecting information about the incident.

"I'm not concerned. We're learning about it. We don't know if it's North Korea, but if it is, we'll talk to them about it," Trump told reporters.

Eric Schiffer, chairman of Patriarch and Reputation Management Consultants, described the incident as an exceptionally significant financial crime.

"I look at this as one of the world's greatest thefts of all time, and it's sad," Schiffer said.

He also warned that increasingly sophisticated cyberattacks could create additional challenges as artificial intelligence technology advances.

"I think the bloodbath of AI hacking is to come," Schiffer said.

"And there's going to be a lot more pain," he added.

Binance has faced significant withdrawal activity since gradually restoring customer access following the breach. According to figures published by CNBC and Yahoo Finance, the exchange processed approximately $4.649 billion in withdrawals and $1.01 billion in deposits on November 1.

The resulting $3.64 billion in net outflows represented approximately 2.1% of Binance's $171 billion in total assets. The exchange reported that withdrawal activity had started declining after an initial surge.

Binance co-CEO Richard Teng said the investigation revealed a complicated security breach involving more than the initially identified compromised laptop.

"This was a complex attack," Teng said.

He also described the attackers' efforts to destroy evidence of their activities.

"The attacker also used a self-destruct mechanism that destroyed tooling and tracers," Teng said.

Binance founder and former CEO Changpeng Zhao attempted to reassure customers about the platform's response, emphasizing that most users had retained their funds on the exchange.

"98% choose to stay!" Zhao wrote on X.

He also highlighted the importance of maintaining customer confidence during the security incident.

"Trust isn't earned by what you say in good times. It's earned by what you do in hard times," Zhao added.

Binance said it had covered approximately 95% of the affected amount, improving from its earlier estimate of 90%. The remaining 5% consisted primarily of less liquid tokens that required additional purchases.

The exchange also committed to absorbing the financial consequences rather than transferring the losses to customers. Meanwhile, Circle confirmed that it had coordinated with law enforcement to freeze more than $1.1 billion in USDC connected to the incident.

"Circle activated its incident response procedures and coordinated with law enforcement to freeze more than $1.1 billion in USDC associated with the incident," a Circle spokesperson told CNBC.

Binance continued purchasing the remaining affected assets while blockchain investigators monitored the movement of cryptocurrency through newly created wallets and cross-chain transactions.