It is now official. On Saturday, October 31, the FBI accused TraderTraitor, North Korea's hacking unit, of the $6.3 billion Binance theft, the first government attribution after two days of private analysts pointing the same way, CBS News and the Associated Press reported. The bureau tied the group to the February 2025 Bybit theft of $1.5 billion and said the hackers are converting the stolen funds into ether while preparing them for "further laundering stages." That matches what blockchain firms have tracked since Thursday. TRM Labs' tally of what left Binance includes 18,270 BTC, about 200,630 ETH, 1.875 billion USDT and 823 million USDC on Ethereum, 233.46 million XRP and 970,500 SOL, according to CoinDesk. Roughly $3 billion of it, mostly stablecoins, was frozen by issuers; the bitcoin and ether cannot be blocked the same way. Naming the unit does not return any coins, but it gives exchanges, over-the-counter desks and swap services a formal reason to refuse the attacker's deposits as the laundering moves to its next stage.