FBI-listed Binance theft addresses hold $2.55bn, none on Treasury sanctions list

The 627 crypto addresses the FBI tied to the Binance theft held about $2.55bn on 9 November 2026 at that day's prices, according to balances Bitminer.io read from the Bitcoin blockchain and Ethereum's main network. Every one of the 627 had a balance. None of them is on the US Treasury sanctions list.

On 31 October the FBI attributed the theft of more than $6 billion from Binance on 29 October to North Korea. It published the addresses and said they "are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors".

Where the money sits

Of the total, $1.37bn was 18,270 BTC across 19 bitcoin addresses. The other $1.18bn was 551,612 ETH across 608 Ethereum addresses.

The balances are uneven. The four largest addresses held 38% of the total, and some held only a few dollars. The largest single address held 197,460 ETH, about $422.9m.

What the balances do not show

A balance shows what sits at an address, not who controls it. The FBI's wording covers addresses that "have held" stolen assets as well as those still holding them, so a balance today does not show which coins are stolen.

The count covers ETH, USDT and USDC only, so other tokens are left out. The FBI did not say which network each address was used on. Bitminer.io read the Ethereum-style addresses on Ethereum alone, so any funds they hold on other networks are not in the $2.55bn.

Sources

1. North Korea Responsible for $6 Billion+ Binance Attack
2. Etherscan: the largest balance among the FBI-published addresses
3. Crypto hacks attributed to North Korea

By The Assayer, the Bitminer.io house byline. Written by AI from the sources above and checked automatically. No person reviewed it before publication. How we work.

Check a crypto address against the US sanctions list and FBI theft notices

Every crypto theft the US attributes to North Korea

Binance’s record: licences, hacks and US cases

More on Binance