On October 31, 2026, the U.S. Federal Bureau of Investigation (FBI) concluded that North Korea was behind the theft of more than $6 billion in crypto assets from the exchange Binance. The incident occurred around October 29, and most of the stolen assets have reportedly been exchanged for ETH, the native cryptocurrency of Ethereum. The FBI is asking crypto-related businesses and others to block not only the wallet addresses it has specified but also transactions derived from them.
However, identifying the perpetrator is a separate matter from recovering the stolen funds. Theft of crypto assets refers to the unauthorized transfer of assets, while freezing means restricting their subsequent movement. Recovery means returning assets to the victims, and reimbursement means an exchange or other party covering customers' losses with other funds. In this case, beyond who carried out the attack, a key question is how funds exchanged into other crypto assets can be tracked and stopped from moving.
FBI Attributes the Theft to North Korea; Stolen Assets Swapped for ETH
In a statement released by the FBI on October 31, the agency attributes the theft to North Korean cyber activity known as "TraderTraitor." TraderTraitor is a name the FBI uses to identify a specific set of cyber operations. However, the statement does not present detailed evidence supporting North Korea's involvement, nor does it describe the specific route by which the attackers penetrated Binance's systems. As a result, the technical cause remains unclear, including whether private keys were leaked or whether a particular device served as the entry point.
Meanwhile, the FBI, the U.S. Secret Service and the IRS Criminal Investigation division are jointly tracing the movement of the stolen funds. These agencies have confirmed that the attackers are mainly exchanging the stolen crypto assets for ETH. The FBI also believes the attackers may continue laundering money through decentralized finance (DeFi) services and services that allow instant exchange of crypto assets.
A distinction is needed here between fund movements already confirmed and the laundering routes expected going forward. The conversion to ETH is a movement observed by investigators, whereas further laundering through DeFi and instant-exchange services is a development the FBI is warning about. It has not been confirmed that the attackers used all of these services or that they have completed the laundering.
Why Attackers Swap Stolen Crypto for ETH
The mechanisms for freezing illicitly transferred assets differ depending on the type of crypto asset. Centralized stablecoins such as USDT have features that allow the issuer to restrict transfers from specific addresses. ETH, by contrast, has no equivalent function that lets a particular issuer unilaterally freeze assets. In other words, when attackers swap stablecoins for ETH, the parties and means capable of stopping the movement of funds change.
Findings published by blockchain analytics firm TRM Labs suggest that the attackers may have tried to exploit these differences. According to the firm, the attackers sold about 325 million USDT and exchanged it for about 122,300 ETH. The exchange rate in this trade works out to roughly $2,650 per ETH, more than 10% worse than the prevailing market price of about $2,300 to $2,350 at the time.
Normally, swapping a large amount of assets at such an unfavorable rate would entail an economic loss. The fact that the attackers hurried the exchange anyway may indicate an intent to move the funds into ETH before the stablecoin issuers could freeze them. TRM Labs also analyzes the move as an effort to avoid freezes. However, the motive behind each individual transaction has not been proven.
The methods the attackers reportedly used went beyond simple sales. According to TRM Labs, in another wallet they deposited 60 million USDT into the DeFi lending service Aave and used it as collateral to borrow about 19,760 ETH. Aave then reportedly froze the related market. This was a response targeting a specific market; it does not mean all Aave services were halted, nor has similar abuse been confirmed across DeFi as a whole.
To cope with such swaps and movements, the FBI is asking that not only the initial destination addresses but also subsequent transactions be blocked. The targets include instant-exchange services, DeFi-related businesses and crypto service providers, as well as THORNode operators, RPC node operators and blockchain analytics firms. By tracking and blocking transactions derived from the designated addresses, the aim is to curb the movement of illicit funds even after they have been exchanged.
The FBI's request, however, does not guarantee that every network operator can block transactions or that blocking will succeed. TRM Labs also reported that roughly $30 million worth of assets were frozen on Arbitrum, but this was a response using that network's exceptional administrative authority. It does not mean ETH on Ethereum in general can be frozen the same way; whether assets can be stopped depends on the mechanisms of the blockchain and smart contracts involved.
$6 Billion-Plus Stolen, $2.7 Billion Frozen: What the Numbers Mean
In this case, alongside the FBI's "more than $6 billion" stolen figure, the roughly $2.7 billion in frozen assets reported by TRM Labs is also drawing attention. But the two figures describe different states of the assets. The stolen amount indicates the scale of assets taken by the attackers, while the frozen amount represents the portion whose movement has been restricted. Frozen assets are not necessarily returned to victims, and that sum cannot simply be treated as the amount recovered.
When comparing published figures, it is necessary to check who compiled them, when, and for which assets. The main figures, based on the FBI's statement and TRM Labs' initial investigation, are as follows.
| Category | Published figure | Scope / timing | What the figure shows |
|---|---|---|---|
| Amount stolen | More than $6 billion | FBI, announced Oct. 31. Incident around Oct. 29 | Scale of the stolen crypto assets |
| Value of outflowed assets | About $6.36 billion | TRM Labs, as of 00:30 UTC on Oct. 30. Valued at prices when assets moved | Value of assets moved off 10 blockchains |
| Amount frozen | About $2.7 billion | TRM Labs, initial observation at the same time | Total assets whose transfer has been restricted |
| Amount recovered | A separate metric from the above | Assets actually returned to victims | The frozen amount alone cannot show how much has been returned |
| Amount reimbursed | A separate metric from the above | Amount an exchange or others covered customers' losses with other funds | Differs from the share of assets taken back from the attackers |
According to TRM Labs, most of the asset movement was concentrated in roughly 20 minutes starting around 20:05 UTC on October 29. The breakdown of the roughly $2.7 billion in frozen assets that it reported is about $2.67 billion in stablecoins and about $30 million from the response on Arbitrum. The latter includes 8,426 ETH and 74.6 million ARB. These are all initial tallies as of 00:30 UTC on October 30 and do not represent the latest recovery figures as of November 1.
TRM Labs also values the same outflowed assets at about $6.23 billion at market prices as of the time of its write-up. The difference from the roughly $6.36 billion based on prices at the time of movement stems from the use of different valuation prices. It also differs in compiler and precision from the FBI's "more than $6 billion" figure, so the gap in amounts does not by itself mean the reports contradict each other.
What matters is not to conflate frozen, recovered and reimbursed amounts. Not all frozen assets will necessarily be returned, and even if an exchange reimburses customers' losses, the attackers' holdings do not shrink by the same proportion. Nor is it appropriate to calculate the final loss by simply subtracting the frozen amount from the stolen amount. To judge how far the damage has been recovered, it is necessary to align the assets and timing covered and then check the amounts actually returned.
Signing Infrastructure Across Multiple Chains May Have Been Compromised
Separate from tracing the stolen assets, how the attackers gained authority to move the funds is also a key subject of the investigation. TRM Labs considers it plausible that signing infrastructure used to approve transfers across multiple blockchains was compromised, putting the attackers in a position to direct signing operations. However, this is the firm's technical hypothesis, not an intrusion cause formally established by the FBI. At this point it has not been determined whether the private keys themselves were leaked or whether the system managing signing operations was compromised.
It has been confirmed that EIP-7702, a mechanism on Ethereum that lets a wallet delegate its behavior to a smart contract, was used. According to TRM Labs, in an operation executed at 20:20 UTC on October 29, 50 pre-signed authorizations were submitted in a single batch. These authorizations had sequential "nonce" values, numbers used for transaction ordering and replay prevention, and those matching the nonce at execution time were used.
As a result, the targeted wallets ended up delegating control to an asset-transfer smart contract that only the attackers could direct. TRM Labs reports that assets subsequently deposited into those wallets were also moved out by the attackers. However, the figure of 50 refers to the number of pre-prepared authorizations; it does not mean 50 private keys were stolen or that 50 thefts occurred. It is also necessary to distinguish between a feature of EIP-7702 being abused and a vulnerability existing in EIP-7702 itself.
On other blockchains as well, transfers carrying valid signatures were confirmed during the same time window. TRM Labs suspects a compromise of a shared signing infrastructure because transfers succeeded on multiple networks even though private key formats and signature schemes differ from blockchain to blockchain. This situation alone, however, cannot show whether private keys were taken out or whether the systems executing signing were hijacked. Which system the attackers first penetrated also remains to be determined.
Based on this analysis, TRM Labs recommends separating signing infrastructure and approval paths by blockchain and wallet tier. The aim is to prevent a situation in which a compromise of a particular management system lets assets be moved across multiple networks at once. It also calls for monitoring unexpected EIP-7702 delegations and bulk signing requests using sequential nonces, and for establishing procedures to promptly revoke unauthorized delegations.
The incident highlights the possibility that, when evaluating the security of a crypto exchange, how private keys are stored may not be enough. Even if keys are kept safely, if the systems that direct signing or the approval paths are compromised, unauthorized transfers carrying legitimate signatures could succeed. Going forward, alongside the status of recovering the stolen assets, clarifying how the attackers seized signing authority and what problems existed in the approval mechanisms spanning multiple chains will be an important task for preventing a recurrence.