FBI says Binance’s stolen assets were converted mainly to Ether

The FBI said it, the U.S. Secret Service and IRS Criminal Investigation observed stolen Binance assets being converted primarily into Ether after the theft on or about October 29, 2026. The agency expected further laundering through decentralized finance (DeFi) and instant-swap services. The FBI’s notice distinguishes the asset conversion investigators observed from the later steps they expected.

What investigators observed in the asset flow

The FBI said more than $6 billion in virtual assets was stolen from Binance. Its notice describes the FBI, the U.S. Secret Service and IRS Criminal Investigation observing the stolen assets being converted mainly into Ether, the cryptocurrency associated with Ethereum.

The FBI expected additional conversions through DeFi and instant-swap services as part of later laundering. That forecast describes a possible next stage in the funds’ movement; the agency reported the Ether conversion as observed activity.

The FBI’s account separates the Ether conversion investigators observed from the later laundering routes they expected.

What the TraderTraitor attribution means

In its October 31 notice, the FBI attributed the theft to North Korea and called the specific malicious cyber activity TraderTraitor. CoinDesk later reported that North Korea denied involvement.

The FBI’s account also adds a view of the funds’ movement to NeoTeo’s earlier timeline of the Binance hack, from fake hiring to wallet signing.

The reported recruitment approach

CoinDesk reported that Binance chief security officer Jimmy Su described an approach to an engineer by someone posing as a project director, followed by a coding assignment containing malware. That account places a recruitment pretext before the theft, which the FBI dates to on or about October 29.