When a crypto exchange is robbed, the first headline reports a number and the second names a culprit. In the Binance case the culprit arrived within days: on Saturday 31 October the FBI said the roughly $6.3 billion theft was carried out by TraderTraitor, a North Korean state-sponsored group. By Sunday, President Donald Trump had said it was not yet known whether North Korea was responsible, according to an AFP report carried by Yahoo Finance (Yahoo Finance/AFP). Two headlines, one event, apparently opposite certainty. This guide gives you five checks for reading an attribution claim, scores the Binance statement on each, and tells you what a reader can and cannot conclude. It follows Field Guide #70 on hack headlines and Field Guide #72 on “we have covered the losses” statements.
Why attribution matters, and why it is hard
Attribution matters to readers for three reasons. It affects whether stolen funds are likely to be recovered: criminal gangs sometimes negotiate, while state-backed groups tend to launder through repeatable pipelines (a general pattern, not a rule). It affects legal exposure: exchanges and individuals who handle laundered funds can face sanctions and compliance consequences. And it is a story that moves attention, which can move prices in the short run. It is hard because blockchain data is public but identity is not. An analyst can follow stolen coins across wallets, but linking a wallet cluster to a named unit involves judgment about operational patterns, tooling, timing and laundering routes, plus information that is sometimes not public.
Video: a short news report on the FBI’s attribution, published 1 November 2026.
Check 1 — Who is speaking, and in what capacity?
A law-enforcement agency saying “we attribute this to X” is a different statement from a politician commenting, a security firm publishing research, or an exchange saying something to reassure customers. Ask which of these you are reading. In the Binance case the FBI is the first source, with analysts at Elliptic and TRM Labs as second sources, and the President’s remark as a political comment. An FBI statement carries the weight of an institution that can see non-public information, such as subpoenaed records or intelligence, though it also has institutional incentives to name a state actor quickly. A security firm’s attribution is a commercial research product; it is often good, and it also serves the firm’s marketing.
Score on Binance: clean. The claim comes from an identifiable agency with the authority to make it, and it is relayed by multiple outlets. The one thing we could not do is read the FBI’s own statement in full; our description comes from the AFP report, so the details below are second-hand.
Check 2 — What is public evidence and what is assertion?
The AFP report says the FBI observed TraderTraitor actors converting stolen assets into ether and expects further laundering through decentralised-finance protocols and instant swap services, and it urged private-sector firms to block transactions linked to the group’s addresses. That is a statement about observed behaviour and about addresses, which is checkable by anyone with a block explorer if the addresses are published. It is not, in the reports we read, a technical explanation of how the group got in, or of why the FBI is confident the group is a state unit. For the 2025 Bybit theft, the FBI published a public service announcement naming TraderTraitor and listing addresses (FBI IC3 PSA, 26 February 2025); we have not confirmed that an equivalent document exists yet for Binance.
Score on Binance: partly. The behaviour claim is concrete, but the evidence behind the attribution is not published in the sources we read. Look for: a public document with addresses, indicator descriptions, and a date.
Check 3 — Is there independent corroboration, and how independent is it?
Elliptic’s analysis is headlined “North Korea likely behind the $6.4 billion Binance hack” (Elliptic), and TRM Labs’ says “North Korea steals $6.36 billion from Binance in the largest hack in history” (TRM Labs). Two firms reaching the same conclusion is meaningful, but they work from the same public chain data and similar methods, and they published after the incident was already widely discussed. So their agreement is corroboration of the on-chain pattern, not an independent confirmation of the FBI’s non-public inputs. Note also the wording: Elliptic says “likely”, TRM states it as fact. The $6.4 billion and $6.36 billion totals differ from Binance’s $6.3 billion by 1–2%, which is normal when firms price tokens at different moments.
Score on Binance: partly. Two reputable analytics firms agree, but the agreement is correlated, and the confidence levels differ.
Check 4 — Does anything in the record contradict it?
A good reader checks the other side. Here there are two items. First, the President’s remark, reported by AFP, that it is not yet known whether North Korea is responsible. Second, the unresolved question of how the attackers entered: Binance has pointed to a potentially compromised engineer’s laptop and said it found no evidence of private-key exposure, while Blockaid has said a hot-wallet key was involved (our first report). Neither contradicts the attribution to a group, because a state unit can use phishing, a compromised endpoint or a stolen key; but they show that the account of the mechanics is not settled. The President’s comment is a political statement, not a technical rebuttal, and we cannot tell from the report whether it reflects a difference of information or of wording.
Score on Binance: not yet. There is no technical contradiction, but there is a visible disagreement on certainty and an open question on method, so a careful reader holds the attribution as “probable, officially asserted”, not “proven”.
Check 5 — What does it change for you?
For most readers the attribution changes little about what to do and a good deal about what to watch. It does not change whether Binance can honour withdrawals, which depends on its reserves and liquidity, covered in Field Guides #71 and #72. It does raise the probability that stolen funds are laundered rather than returned, and it puts pressure on exchanges, stablecoin issuers and DeFi front ends to freeze or block flagged addresses. It has no reliable relationship with price. Our study of eight exchange hacks and halts looked at price moves around the events, not at who the thief was, so we have no evidence that attribution itself moves bitcoin.
Score on Binance: informational. Useful for risk awareness, not a signal to trade.
The scorecard
| Check | Question | Binance / FBI statement |
|---|---|---|
| 1. Source | Who said it, with what authority? | Clean — FBI, relayed by AFP; full text not read |
| 2. Evidence | What is published vs asserted? | Partly — behaviour described; method and indicators not seen |
| 3. Corroboration | Is there independent confirmation? | Partly — Elliptic and TRM agree, but not independent of the same public data |
| 4. Contradiction | Does the record disagree? | Not yet — presidential caution and an open entry-method question |
| 5. Consequence | What does it change for you? | Informational — watch for address freezes, not price |
Result: one clean, two partly, one not-yet, one informational. That is a normal profile for a statement made four days after an event. The right posture is neither to dismiss the attribution nor to treat it as final.
A reusable checklist
- Name the speaker and their role before you read the claim.
- Look for a primary document (a public alert, court filing or technical report), not just a quote relayed by outlets.
- Separate “observed behaviour” (checkable) from “identity” (judgment) in every sentence.
- Count independent sources, not outlets: five articles repeating one statement are one source.
- Note wording differences — “likely”, “suspected”, “attributed” — and keep them in your own summary.
- Ask what the claim changes for you before you act on it.
Video: The National Desk report from 30 October 2026, before the FBI statement; it shows the “suspected” wording used at the time.
What we will do next
We will check whether the FBI publishes a Binance-specific alert with addresses, whether exchanges or issuers announce freezes, and whether Binance publishes a post-mortem and reserves report. When any of them appear we will update this scorecard. The weekday dates we are watching are Monday 2 November for the reserves report that Field Guide #71 pre-registered, and Saturday 7 November, seven days after the event, for the market-reaction follow-up to our hack study.
Sources: Yahoo Finance/AFP, 1 November 2026, Elliptic, TRM Labs, FBI IC3, 2025, CNN, 30 October 2026.
Method: bitcoin prices, highs, lows and closes are Coinbase Exchange candles (UTC day) and the Coinbase spot ticker pulled by Bitcoin Mastery at about 07:08 UTC on Monday 2 November 2026; the 2 November candle is still open at that time, so the latest price is the 78,106.83 ticker and the last completed daily close is Sunday 1 November (78,230.55). Long-history bitcoin figures are Yahoo Finance BTC-USD monthly closes. Third-party figures are attributed to their source and date. The FBI statement is described as reported by AFP; we did not read the FBI’s own text. Scores are our editorial judgment, not an official rating.
Disclaimer: This article is for informational purposes only and does not constitute investment advice. Bitcoin and other cryptocurrencies are volatile and you can lose some or all of the money you put in. Nothing here is a recommendation to buy, sell or hold bitcoin, any exchange-traded fund, any listed security or any other asset, and the technical levels, probabilities and scenarios discussed are descriptions of published data, not forecasts. Do your own research and consult a licensed financial advisor before making investment decisions.