Case file — Lead incident: The FBI has formally attributed the record theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance to North Korea. In a public alert issued October 31, 2026, the bureau blamed the activity it tracks as TraderTraitor — also tracked as Lazarus Group and APT38 — for the theft carried out on or about October 29, 2026. Blockchain investigators at TRM Labs put the haul at about $6.36 billion moved across ten blockchains in roughly 20 minutes, making it the largest cryptocurrency theft on record, about four times the $1.5 billion Bybit heist of February 2025. Binance says it has set aside about $6.34 billion of company funds to cover the loss, that customers will not bear it, and that it had replenished roughly 90% of the affected assets by October 31, with phased withdrawal reopening targeted for November 1. The FBI says it has observed the actors converting stolen assets primarily into Ethereum and expects further laundering through decentralized finance and instant-swap services; it published 628 associated addresses and urged crypto businesses to block transactions tied to them.
Status: Attribution confirmed by the FBI on October 31; asset recovery and laundering tracking ongoing. The FBI's alert does not detail how the attackers gained initial access; Binance has said the attack began with a compromised laptop belonging to a DevOps engineer. No independent audit of the replenishment claim has been published.
Incident timeline
| Date | Development |
|---|---|
| Oct 29, ~20:05 UTC | About $6.36 billion in digital assets is moved out of Binance-controlled wallets across ten blockchains, most of it within roughly 20 minutes, according to TRM Labs. |
| Oct 29–30 | CISA adds actively exploited flaws in Cisco ASA/FTD, GitLab, Ivanti Connect Secure, PHP, VMware ESX and the Linux kernel to its KEV catalog (Oct 26–30). |
| Oct 30 | Binance halts withdrawals, says it will cover losses from company funds, and reports freezing around $3 billion of stolen assets with partners. |
| Oct 31 | The FBI issues its TraderTraitor attribution alert for the Binance theft and publishes 628 associated addresses. Binance says about 90% of affected assets are replenished and withdrawals will reopen in phases from November 1. |
| Oct 31 | October ransomware tallies land: HackerFeeds counts 1,127 leak-site claims (+25.8% on September); Breachsense counts 953 claimed victims across 81 groups. |
| Nov 1 | Fresh leak-site claims surface for Qilin, Barracuda, Shiba, LockBit5, HYFLOCK and The Gentlemen, naming victims in Germany, Japan, Turkey, Indonesia and the United States. None is independently confirmed. |
| Nov 2 (today) | CISA's federal remediation deadline for Ivanti Connect Secure CVE-2026-111357 arrives; the companion flaw CVE-2026-118527 is due November 13. |
1. FBI blames North Korea's TraderTraitor for the record $6.3B Binance heist
The FBI's October 31 alert is the first government confirmation of what TRM Labs and Chainalysis had already assessed with high confidence: the Binance theft was a North Korean operation. The bureau, working with the U.S. Secret Service and IRS Criminal Investigation, says TraderTraitor actors have been observed converting the stolen assets primarily into Ethereum, with further laundering expected through DeFi platforms and instant-swap services. The alert lists 628 addresses — 608 on Ethereum, 19 on Bitcoin and one on Solana — and asks node operators, exchanges, DeFi services and analytics firms to block transactions tied to them.
Investigation notes
The scale resets the record books: at about $6.36 billion, the Binance theft is roughly four times the $1.5 billion Bybit theft of February 2025, which the FBI also attributed to North Korea. TraderTraitor has previously been linked to the Alphapo, CoinsPaid and Atomic Wallet thefts of 2023. Binance's recovery claim — about 90% of assets replenished from company funds, the SAFU reserve and its futures insurance fund, with the remaining 10% in less liquid tokens — has not been independently audited, and the FBI's alert offers little technical evidence for the attribution itself. The intrusion vector remains officially undisclosed; Binance has pointed to a compromised DevOps engineer's laptop. Defenders in crypto-adjacent firms should treat the published address list as a blocklist input and watch for ETH consolidation and swap-service hops, the laundering pattern the FBI flags.
2. CISA's Ivanti deadline lands today as the KEV catalog swells with exploited edge flaws
CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog on October 30 after confirming exploitation in the wild: CVE-2026-111357 (missing authentication, CVSS 8.8) and CVE-2026-118527 (predictable identifier generation allowing a remote authenticated attacker to upload files to a known location). They are exploited chained with CVE-2026-104935, an authentication bypass added to KEV on October 13. Volexity documented the chain and attributed it to a previously undocumented actor tracked as UTA0576, which can reach root-level compromise and credential theft. Federal civilian agencies must remediate CVE-2026-111357 by today, November 2, and CVE-2026-118527 by November 13; Ivanti fixed versions are 25.1.1.3, 25.1.3.1 and 22.8R2.6 depending on branch, and CISA marks CVE-2026-111357 for forensic triage.
Investigation notes
The Ivanti additions cap a heavy KEV week: Cisco Secure Firewall ASA/FTD CVE-2026-76418 (CVSS 8.6, unauthenticated firewall reload via Remote Access SSL VPN with secondary authentication — no successful VPN login required), GitLab CE/EE CVE-2026-97229 (CVSS 10.0, integer overflow in the CI/CD regex compiler allowing unauthenticated remote code execution; fixed in 19.2.8, 19.3.5 and 19.4.2), PHP flaws CVE-2026-109618 and CVE-2026-109619 (which Palo Alto Networks says are being exploited against PAN-OS management interfaces), and VMware ESX and Linux kernel flaws were all added between October 26 and 30. Alpine Linux reported attempted exploitation of its GitLab instance on October 20–21 with no evidence of successful code execution. For Ivanti owners, the chain matters more than any single CVE: patch to a fixed release, hunt for the UTA0576 indicators, and treat any appliance exposed during the exploitation window as potentially credential-compromised.
3. October was the busiest ransomware month of the autumn — claims, not confirmed breaches
Ransomware crews posted 1,127 victims on their leak sites in October 2026, a 25.8% jump from 896 in September, according to the HackerFeeds monthly report dated October 31 — the busiest month of the autumn on that tracker, with 79 active groups, 7 brand-new brands and a single-day peak of 73 claims on October 26. Three crews carried the load: N0n (154 claims), The Gentlemen (143) and Qilin (140), together about 38.8% of the month's listings. A second tracker, Breachsense, counts 953 claimed victims across 81 groups and 76 countries, up from 789 in September, and puts The Gentlemen first at 135 with Qilin second at 110; 46 of October's victims were law firms, up from 34 in September.
Investigation notes
The two tallies disagree by 174 victims, and both count leak-site claims, not confirmed breaches — a listing is an allegation by the criminals, and trackers diverge by double digits on methodology. The direction, however, is consistent across trackers: October set a 2026 pace, with the year's claimed total reaching 7,807 on Breachsense's count, already past the 7,307 claimed in all of 2025. The concentration also matters: three groups account for nearly two-fifths of claims, so tracking N0n, The Gentlemen and Qilin infrastructure and affiliate tooling covers a disproportionate share of the current threat. For disclosure teams, the practical read is that a leak-site listing is a starting point for verification, not a breach confirmation — and the October surge means more of those verifications are landing each week.
4. Fresh November 1 leak-site claims span five countries — all unverified
The first day of November brought a fresh batch of ransomware leak-site claims, none of them independently confirmed as successful intrusions: Qilin listed German natural-cosmetics retailer CMD Naturkosmetik and Japanese manufacturer Shibata Co., Ltd.; Barracuda listed Turkish hotel-and-restaurant supplier EVINOKS and said it would release unsold data for free; Shiba listed German heating-services firm Tema Hwt; LockBit5 listed Indonesian consultancy PT Synergy; and HYFLOCK listed U.S. IT firm Hitech Group while The Gentlemen listed U.S. firm Bi Link. Threat-intelligence monitoring flagged the claims on November 1–2; in the U.S. cases, monitors explicitly note there is no verified evidence of encryption or exfiltration.
Investigation notes
These claims are reported here as claims only, per the standing evidence rule: a leak-site listing is not a confirmed breach, and no scale, data volume or intrusion detail should be inferred from a listing alone. The geographic spread — Germany, Japan, Turkey, Indonesia and the United States — mirrors October's pattern of broad, opportunistic targeting rather than a single-sector campaign, and Qilin's continued activity fits its position as one of October's top three claiming groups. Organizations named in such listings should verify independently before treating the claim as an incident, and defenders should note Barracuda's free-release tactic, which raises exposure even for victims that do not pay.
Sources
- SecurityAffairs — FBI Blames North Korea for $6 Billion Binance Crypto Theft
- Binance covers 90% of $6.3bn hack — but North Korea's TraderTraitor is still laundering the rest
- Undercode News — CISA Adds Two Ivanti Connect Secure Vulnerabilities to KEV After Active Exploitation
- RunbookLabHQ — CISA KEV this week: Cisco ASA, GitLab, Ivanti, PHP
- NeoTeo — GitLab CVE-2026-97229: KEV listing and fixes
- Tech Insider — Ransomware Attacks October 2026: 1,127 Claims, +25.8%
- Breachsense — October 2026 Ransomware Report: 953 Victims, 81 Groups
- Undercode News — HYFLOCK and The Gentlemen Claim Two New Ransomware Victims in the United States
