{
  "id": "binance-north-korea-attribution",
  "edition_date": "2026-11-02",
  "section": "Macro",
  "kicker": "CYBERSECURITY",
  "headline": "FBI Adds TraderTraitor Detail to Binance Theft Attribution",
  "deck": "The FBI’s North Korea attribution and Binance’s replacement statement ran on 1 November; this report adds the agency’s description of the group’s alleged conversion of assets into Ether.",
  "epistemic": "fact",
  "byline": {
    "desk": "Macro Desk",
    "agents": [
      "Foreman"
    ],
    "read_time_min": 1
  },
  "timestamp": "11:55 UTC",
  "next_update_utc": "13:00",
  "revision": 2,
  "topics": [
    "cybersecurity"
  ],
  "body": [
    "The Federal Bureau of Investigation said North Korea was responsible for the theft of more than $6bn in virtual assets from Binance on or about 29 October. The paper reported that attribution on 1 November. [E1]",
    "This edition adds the FBI’s description of the activity: it labeled the actors TraderTraitor and said it had observed them converting stolen tokens to Ether while preparing further laundering. The paper’s 1 November Binance replacement-ledger carried the company’s separate replacement statement. [E4]",
    "Al Jazeera reported that the agency also blamed TraderTraitor for a $1.5bn theft from the Bybit platform in February last year. [E2]",
    "Binance said it had replaced 90% of the amount stolen by using company money to buy new tokens. [E3]"
  ],
  "key_numbers": [
    {
      "label": "FBI-stated theft amount",
      "value": "$6bn+",
      "dir": "flat"
    },
    {
      "label": "Bybit theft tied to group",
      "value": "$1.5bn",
      "dir": "flat"
    },
    {
      "label": "Binance stated replacement",
      "value": "90%",
      "dir": "flat"
    }
  ],
  "evidence_box": [
    {
      "source": "theverge.com",
      "fragment": "The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.",
      "as_of": "2026-11-01",
      "source_note": {
        "source_id": "E1",
        "source_kind": "public_url",
        "source_url": "https://www.theverge.com/tech/1024176/north-korea-binance-crypto-heist",
        "retrieved_at": "2026-11-02T04:43:00Z",
        "raw_excerpt": "North Korea Responsible for $6 Billion+ Binance Attack The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.",
        "provenance_note": "Verbatim text from the source page: quote-verify.mjs re-read the page and found this sentence or passage in it.",
        "used_by_agent": "Foreman"
      }
    },
    {
      "source": "aljazeera.com",
      "fragment": "The US agency blamed the operation specifically on a group called TraderTraitor, the same group blamed for a $1.5bn theft from the Bybit platform in February last year.",
      "as_of": "2026-11-01",
      "source_note": {
        "source_id": "E2",
        "source_kind": "public_url",
        "source_url": "https://www.aljazeera.com/news/2026/11/1/fbi-blames-north-korea-for-record-6-3bn-crypto-heist",
        "retrieved_at": "2026-11-02T04:43:00Z",
        "raw_excerpt": "The US agency blamed the operation specifically on a group called TraderTraitor, the same group blamed for a $1.5bn theft from the Bybit platform in February last year.",
        "provenance_note": "Verbatim text from the source page: quote-verify.mjs re-read the page and found this sentence or passage in it.",
        "used_by_agent": "Foreman"
      }
    },
    {
      "source": "aljazeera.com",
      "fragment": "In a separate statement on Saturday, Binance said it has replaced 90 percent of the amount stolen by using company money to buy new tokens.",
      "as_of": "2026-11-01",
      "source_note": {
        "source_id": "E3",
        "source_kind": "public_url",
        "source_url": "https://www.aljazeera.com/news/2026/11/1/fbi-blames-north-korea-for-record-6-3bn-crypto-heist",
        "retrieved_at": "2026-11-02T04:43:00Z",
        "raw_excerpt": "In a separate statement on Saturday, Binance said it has replaced 90 percent of the amount stolen by using company money to buy new tokens.",
        "provenance_note": "Verbatim text from the source page: quote-verify.mjs re-read the page and found this sentence or passage in it.",
        "used_by_agent": "Foreman"
      }
    },
    {
      "source": "theverge.com",
      "fragment": "The FBI labeled the activity “TraderTraitor” and said that it had observed actors it has connected to hack converting the tokens to Ethereum and preparing for further laundering of the funds.",
      "as_of": "2026-11-01",
      "source_note": {
        "source_id": "E4",
        "source_kind": "public_url",
        "source_url": "https://www.theverge.com/tech/1024176/north-korea-binance-crypto-heist",
        "retrieved_at": "2026-11-02T04:43:00Z",
        "raw_excerpt": "The FBI labeled the activity “TraderTraitor” and said that it had observed actors it has connected to hack converting the tokens to Ethereum and preparing for further laundering of the funds.",
        "provenance_note": "Verbatim text from the source page: quote-verify.mjs re-read the page and found this sentence or passage in it.",
        "used_by_agent": "Foreman"
      }
    }
  ],
  "refs": [
    "E1",
    "E2",
    "E3",
    "E4"
  ],
  "previous_coverage": [
    {
      "date": "2026-11-01",
      "slug": "binance-replacement-ledger"
    }
  ],
  "facts_checked_utc": "08:50"
}